« Volver al listado

CVE-2026-21714

Estado: AnalizadaMedia (5.3)—

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nodejs — Node.js

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-21714",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21714",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-31T16:14:45.777607Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "support@hackerone.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "nodejs",
          "product": "node",
          "versions": [
            {
              "status": "affected",
              "version": "20.20.1",
              "versionType": "semver",
              "lessThanOrEqual": "20.20.1"
            },
            {
              "status": "affected",
              "version": "22.22.1",
              "versionType": "semver",
              "lessThanOrEqual": "22.22.1"
            },
            {
              "status": "affected",
              "version": "24.14.0",
              "versionType": "semver",
              "lessThanOrEqual": "24.14.0"
            },
            {
              "status": "affected",
              "version": "25.8.1",
              "versionType": "semver",
              "lessThanOrEqual": "25.8.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-30T20:16:19.573",
  "references": [
    {
      "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\r\n\r\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25."
    },
    {
      "lang": "es",
      "value": "Se produce una fuga de memoria en servidores HTTP/2 de Node.js cuando un cliente envía tramas WINDOW_UPDATE en el flujo 0 (a nivel de conexión) que hacen que la ventana de control de flujo exceda el valor máximo de 2³¹-1. El servidor envía correctamente una trama GOAWAY, pero el objeto Http2Session nunca se limpia.\n\nEsta vulnerabilidad afecta a los usuarios de HTTP2 en Node.js 20, 22, 24 y 25."
    }
  ],
  "lastModified": "2026-08-19T13:35:56.083",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42C896A4-ABB4-4DF3-8F8B-320C8E8E6AA3",
              "versionEndIncluding": "20.20.1"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5317F856-6549-4E7C-B6B8-811DE991E7A7",
              "versionEndIncluding": "22.22.1",
              "versionStartIncluding": "22.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD9D3210-E42B-4584-817D-DAC5F1234234",
              "versionEndIncluding": "24.14.0",
              "versionStartIncluding": "24.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89D03065-041A-4A59-95C4-B2AE7EE36439",
              "versionEndIncluding": "25.8.1",
              "versionStartIncluding": "25.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}