CVE-2026-111510: Node.js HTTP/2 CONTINUATION Frame Flood Mitigation
An incomplete frame counter reset in Node.js node:http2 session handling allows remote clients sending interleaved HEADER and CONTINUATION frames to exhaust event-loop CPU and memory before maxSessionMemory limits terminate the stream.
Executive Summary & Technical Impact
An incomplete frame counter reset in Node.js node:http2 session handling allows remote clients sending interleaved HEADER and CONTINUATION frames to exhaust event-loop CPU and memory before maxSessionMemory limits terminate the stream.
Tracked under CVE-2026-111510 (CWE-400 (Uncontrolled Resource Consumption)), this vulnerability affects Node.js 20.x, 22.x, 24.x, 25.x / 26.x and carries a severity score of 7.5 (HIGH). Engineering and security operations teams running Node.js Runtime should prioritize upgrading to Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1.
Remediation & Patch Guidance
- Upgrade Node.js to the October 2026 security release line.
- Terminate public HTTP/2 traffic at a hardened edge proxy (Envoy, Cloudflare, Nginx, or AWS ALB) with strict frame rate limits.
Frequently Asked Questions (CVE-2026-111510)
What versions are affected by CVE-2026-111510?
CVE-2026-111510 affects Node.js 20.x, 22.x, 24.x, 25.x / 26.x in Node.js Runtime (Node.js HTTP/2 CONTINUATION Frame Flood Mitigation).
How do I patch or remediate CVE-2026-111510?
Upgrade affected deployments to Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1 and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-111510?
CVE-2026-111510 is rated HIGH with a CVSS score of 7.5 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Node.js October 2026 Security Emergency: Brotli RCE (CVE-2026-111497) & TLS Validation Bypass
A deep technical breakdown of the October 2026 Node.js security releases addressing a critical out-of-bounds write in the bundled Brotli decoder and NUL byte DNS truncation.
Read full engineering post-mortem (7 min read) →