CVE-2026-486195.3MediumCWE-400
nodejs node vulnerability
nodejs · node
Not in CISA KEV
0.6%probability of exploitation in the next 30 days
50th percentile
050100
Higher than 50% of scored CVEs
5.3MediumCVSS 3.0
LowMediumHighCrit.
DescriptionNVD
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 18 Jun.
- Node.js fixes critical WebCrypto TLS flaws in urgent updateSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.