Is CVE-2026-56846 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-56846?

CVE-2026-56846 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-56846

Description

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.