Vulnerability intelligence

CVE-2026-48619

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

CVSS Score

5.3

Medium

EPSS — Exploit Probability

0.6%

Riskier than 49% of all CVEs · checked 2026-09-14

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry

1 article across 1 outlet · first covered Jun 18, 2026 · latest Jun 18, 2026

Coverage timeline

Node.js fixes critical WebCrypto TLS flaws in urgent update
securityonline.info · Jun 18, 2026

Related CVEs — nodejs

CVE-2026-56848 CVE-2026-56846 CVE-2026-58043 CVE-2026-48933 CVE-2026-48618 CVE-2026-48615 CVE-2026-48617 CVE-2026-48930