CVE-2026-48937: A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported…

PriorityP429medium5.3CVSS 3.0

AVNACLPRNUINSUCNINAL

EPSS

0.45%

35.5th percentile

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
nodejs	node	22.22.3 – 22.22.3	—
nodejs	node	24.16.0 – 24.16.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.