Http response is not ended although underlying socket is already destroyed #676710 Informative Denial of Service – 2020-01-15 – 1 Node.js HTTP/2 Large Settings Frame DoS #446662 Valid Denial of Service – 2020-07-02 – 2 DNS Max Responses for DOS #1033107 Valid Denial of Service – 2020-12-16 $250 2 Fix for CVE-2018-12122 can be bypassed via keep-alive requests #453513 Valid Denial of Service – 2020-02-13 – 3 HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion #1043360 Valid Denial of Service – 2021-03-15 – 3 Regular Expression Denial of Service in Headers #1784449 Valid Denial of Service Low 2023-03-19 – 3 Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames #3676863 Valid Denial of Service Medium 2026-06-25 – 4 Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion #3531737 Valid Denial of Service Medium 2026-03-30 – 7 Slowloris, body parsing #799072 Valid Denial of Service – 2020-10-17 $250 8 Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests #868834 Valid Denial of Service – 2020-10-17 $250 8 Multiple HTTP/2 DOS Issues #589739 Valid Denial of Service – 2019-08-16 – 9 dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records #3795657 Valid Denial of Service Medium 2026-08-28 – 12 HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion #3846922 Valid Denial of Service High 2026-08-28 – 12 Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) #3857258 Valid Denial of Service Medium 2026-08-28 – 12 http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks #2233486 Valid Denial of Service High 2024-02-15 – 13 GOAWAY HTTP/2 frames cause memory leak outside heap #2841362 Valid Denial of Service Medium 2025-02-06 – 13 Malformed HTTP/2 SETTINGS frame leads to reachable assert #800140 Valid Denial of Service – 2020-07-03 $250 14 Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process) #3560402 Valid Denial of Service High 2026-03-30 – 22 Denial of Service by resource exhaustion in fetch() brotli decoding #2284065 Valid Denial of Service Medium 2024-03-16 – 27 HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors #3658225 Valid Denial of Service Medium 2026-06-18 – 33 Memory leak that enables remote Denial of Service against applications processing TLS client certificates #3357723 Valid Denial of Service Medium 2026-02-12 – 34 Assertion error in node_url.cc via malformed URL format leads to Node.js crash #3546390 Valid Denial of Service Medium 2026-03-26 – 40 Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions #3781015 Informative Denial of Service High 2026-06-12 – 41 "Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash #2319584 Valid Denial of Service High 2024-04-08 – 65 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak #3473882 Valid Denial of Service Medium 2026-02-12 – 81