CVE-2026-56846

A flaw in the HTTP/2 handling of Node.js versions 24.x and 22.x allows retained header blocks to bypass the maxSessionMemory limit, potentially leading to remote memory exhaustion. This could enable an attacker to deplete server resources, resulting in service degradation or denial of service. Organizations using these versions of Node.js should prioritize remediation to mitigate the risk of exploitation.