Search: CVE-2026-75804

A vulnerability in the OpenSSL QUIC stack used by Node.js allows a remote peer to bypass connection-level flow control for streams. This can lead to excessive memory allocation on the local system, potentially up to 100MB per connection instead of the intended 768 KiB. Exploitation requires specific conditions involving multiple streams and data patterns. The OpenSSL FIPS module is not affected as the QUIC implementation lies outside its boundary. The issue has a CVSS score of 5.3 (low severity) and affects multiple specific Node.js versions. A patch is available to address this vulnerability.