A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the… (CVE-2026-48619)
A vulnerability in the Node.js HTTP/2 client allows a malicious server to send an unlimited number of ORIGIN frames, potentially causing an Out of Memory (OOM) error on the client. This affects multiple supported Node.js release lines including versions in the 22, 24, and 26 series. The flaw could disrupt client operations by exhausting memory resources. A patch is available for the affected versions.
AI Analysis
Technical Summary
CVE-2026-48619 is a vulnerability in the Node.js HTTP/2 client where a server can send an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client side. The issue affects Node.js versions >=22.22.3 <22.23.0, >=24.16.0 <24.17.0, and >=26.3.0 <26.3.1. The vulnerability has been assigned a high severity rating. No CVSS score is provided. A patch is available to address this issue.
Potential Impact
Exploitation of this vulnerability can cause the Node.js HTTP/2 client to consume excessive memory, resulting in an Out of Memory condition. This can lead to application crashes or denial of service on the client side. There is no indication of remote code execution or data leakage from the provided data.
Mitigation Recommendations
A patch is available for the affected Node.js versions. Users should update to the fixed versions beyond >=22.23.0, >=24.17.0, and >=26.3.1 as appropriate. Applying these updates will mitigate the risk of Out of Memory errors caused by this vulnerability.
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the… (CVE-2026-48619)
Description
A vulnerability in the Node.js HTTP/2 client allows a malicious server to send an unlimited number of ORIGIN frames, potentially causing an Out of Memory (OOM) error on the client. This affects multiple supported Node.js release lines including versions in the 22, 24, and 26 series. The flaw could disrupt client operations by exhausting memory resources. A patch is available for the affected versions.
Affected software
pkg:bitnami/nodeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48619 is a vulnerability in the Node.js HTTP/2 client where a server can send an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client side. The issue affects Node.js versions >=22.22.3 <22.23.0, >=24.16.0 <24.17.0, and >=26.3.0 <26.3.1. The vulnerability has been assigned a high severity rating. No CVSS score is provided. A patch is available to address this issue.
Potential Impact
Exploitation of this vulnerability can cause the Node.js HTTP/2 client to consume excessive memory, resulting in an Out of Memory condition. This can lead to application crashes or denial of service on the client side. There is no indication of remote code execution or data leakage from the provided data.
Mitigation Recommendations
A patch is available for the affected Node.js versions. Users should update to the fixed versions beyond >=22.23.0, >=24.17.0, and >=26.3.1 as appropriate. Applying these updates will mitigate the risk of Out of Memory errors caused by this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-node-2026-48619
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-48619"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6aa005faacd9273b49ab687d
Added to database: 09/08/2026, 12:56:26 UTC
Last enriched: 09/08/2026, 13:35:37 UTC
Last updated: 09/09/2026, 01:13:58 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.