CVE-2026-27135
High · 7.5CVSS
7.5
EPSS
0.9%
Published
Mar 18, 2026
CISA due date
—
The record
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | nghttp2 | 0 | 1.40.0-150600.25.5.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | nghttp2 | 0 | 1.40.0-150600.25.5.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | nghttp2 | 0 | 1.40.0-150600.25.5.1 |
| openSUSE:Leap 15.6 | nghttp2 | 0 | 1.40.0-150600.25.5.1 |
| openSUSE:Leap 15.6 | nghttp2-python | 0 | 1.40.0-150600.25.5.1 |
| openSUSE:Leap 16.0 | nghttp2 | 0 | 1.64.0-160000.3.1 |
| openSUSE:Leap 16.0 | nodejs22 | 0 | 22.23.0-160000.1.1 |
| openSUSE:Tumbleweed | nghttp2 | 0 | 1.68.1-1.1 |
| openSUSE:Tumbleweed | nodejs24 | 0 | 24.17.0-1.1 |
Related vulnerabilities
- CVE-2026-48935 A flaw in Node.js Permission API can cause a file metadata to be modified even on a path… Also affects nodejs22
- CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling… Also affects nodejs22
- CVE-2026-48930 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to… Also affects nodejs22
- CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in… Also affects nodejs22
- CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN… Also affects nodejs22
- CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of… Also affects nodejs22
- CVE-2026-48928 A inconsistency in Node.js hostname matching can cause a trust-policy bypass in… Also affects nodejs22
- CVE-2026-48934 A flaw in Node.js TLS host verification can cause an attacker to bypass certification… Also affects nodejs22