A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control… (CVE-2026-21714)
A memory leak vulnerability exists in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 that cause the flow control window to exceed the maximum allowed value. Although the server responds with a GOAWAY frame, the associated Http2Session object is not properly cleaned up, leading to resource leakage. This affects multiple Node.js versions including 20, 21, 23, and 25 within specified version ranges.
AI Analysis
Technical Summary
CVE-2026-21714 describes a memory leak in Node.js HTTP/2 servers triggered by client-sent WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed 2³¹-1. The server correctly sends a GOAWAY frame to terminate the connection, but the Http2Session object remains allocated and is not cleaned up, resulting in a memory leak. This issue affects Node.js versions prior to 20.20.2, versions from 21.0.0 up to but not including 22.22.2, versions from 23.0.0 up to but not including 24.14.1, and versions from 25.0.0 up to but not including 25.8.2.
Potential Impact
The vulnerability causes a memory leak on affected Node.js HTTP/2 servers, which could degrade server performance or lead to resource exhaustion over time. The server does send a GOAWAY frame to close the connection properly, but the lingering Http2Session object consumes memory unnecessarily. There is no indication of direct code execution or data compromise from this vulnerability.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to Node.js versions 20.20.2 or later, 22.22.2 or later, 24.14.1 or later, and 25.8.2 or later to remediate this issue. No additional mitigation steps are indicated beyond applying the official fixes.
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control… (CVE-2026-21714)
Description
A memory leak vulnerability exists in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 that cause the flow control window to exceed the maximum allowed value. Although the server responds with a GOAWAY frame, the associated Http2Session object is not properly cleaned up, leading to resource leakage. This affects multiple Node.js versions including 20, 21, 23, and 25 within specified version ranges.
Affected software
pkg:bitnami/nodeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-21714 describes a memory leak in Node.js HTTP/2 servers triggered by client-sent WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed 2³¹-1. The server correctly sends a GOAWAY frame to terminate the connection, but the Http2Session object remains allocated and is not cleaned up, resulting in a memory leak. This issue affects Node.js versions prior to 20.20.2, versions from 21.0.0 up to but not including 22.22.2, versions from 23.0.0 up to but not including 24.14.1, and versions from 25.0.0 up to but not including 25.8.2.
Potential Impact
The vulnerability causes a memory leak on affected Node.js HTTP/2 servers, which could degrade server performance or lead to resource exhaustion over time. The server does send a GOAWAY frame to close the connection properly, but the lingering Http2Session object consumes memory unnecessarily. There is no indication of direct code execution or data compromise from this vulnerability.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to Node.js versions 20.20.2 or later, 22.22.2 or later, 24.14.1 or later, and 25.8.2 or later to remediate this issue. No additional mitigation steps are indicated beyond applying the official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-node-2026-21714
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-21714"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6aa005faacd9273b49ab6883
Added to database: 09/08/2026, 12:56:26 UTC
Last enriched: 09/08/2026, 13:36:03 UTC
Last updated: 09/10/2026, 19:36:52 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.