CVE-2026-48937: A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame

High severity · published Jun 18, 2026

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame

7.5

CVSS

0.6%

EPSS

On KEV

Description

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 47% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

node · nodejs

22.22.3 through 22.22.3; 24.16.0 through 24.16.0 · source: vendor

Node.js · Nodejs

22.0 before 22.23.0; 24.0.0 before 24.17.0 · source: NVD

Affected product

node

nodejs

All node CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-48937

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-48937

Issue Tracking

https://hackerone.com/reports/3658225

Patch

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases