CVE-2026-123868 is a vulnerability in Node.js versions 24.x and 26.x where an unauthenticated HTTP/2 client can exhaust server memory. The issue arises because inbound DATA frames queued on an undrained stream are not properly accounted against the session memory budget, allowing excessive memory retention. This can lead to denial of service by exhausting server resources.