CVE-2026-48937 in Node.js 22.16.0
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
- Severity
- High 7.5
- Exploitation
-
1% chance of exploit
in the next 30 days - Fix
- Update to 22.23.0, 24.17.0
- Where
- App / API
- How it matched
- Exact version match
- First seen
- 2026-11-05 01:13:58 UTC
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2026-48937