CVE-2026-48937

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48937
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48937.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48937
Aliases
Downstream
ALPINE (1)
ALSA (6)
AZL (1)
BELL (1)
CGA (10)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (6)
openSUSE (3)
RHSA (8)
SUSE (10)
UBUNTU (1)
Related
ALSA (6)
openSUSE (3)
SUSE (10)
Published
2026-06-18T18:01:39Z
Modified
2026-10-29T11:42:19Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24.

Database specific 
{
    "cna_assigner":  "hackerone",
    "cwe_ids":  [
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48937.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "22.22.3"
                        },
                        {
                            "last_affected":  "22.22.3"
                        },
                        {
                            "introduced":  "24.16.0"
                        },
                        {
                            "last_affected":  "24.16.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
12fb157f79da8c094a54bc99370994941c28c235
Fixed
eb77496085a730a72939ef32a90b841f344eb4b0
Introduced
c5349f43cd66d2aa02d86414c9ed426f71d3ae48
Fixed
413e874773eef1e27a8397ddc949dbbe19cadb31
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "range":  [
                {
                    "introduced":  "22.0"
                },
                {
                    "fixed":  "22.23.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "range":  [
                {
                    "introduced":  "24.0.0"
                },
                {
                    "fixed":  "24.17.0"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

v22.*
v22.0.0
v22.1.0
v22.10.0
v22.11.0
v22.12.0
v22.13.0
v22.13.1
v22.14.0
v22.15.0
v22.15.1
v22.16.0
v22.17.0
v22.17.1
v22.18.0
v22.19.0
v22.2.0
v22.20.0
v22.21.0
v22.21.1
v22.22.0
v22.22.1
v22.22.2
v22.22.3
v22.3.0
v22.4.0
v22.4.1
v22.5.0
v22.5.1
v22.6.0
v22.7.0
v22.8.0
v22.9.0
v24.*
v24.0.0
v24.0.1
v24.0.2
v24.1.0
v24.10.0
v24.11.0
v24.11.1
v24.12.0
v24.13.0
v24.13.1
v24.14.0
v24.14.1
v24.15.0
v24.16.0
v24.2.0
v24.3.0
v24.4.0
v24.4.1
v24.5.0
v24.6.0
v24.7.0
v24.8.0
v24.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48937.json"