TNCVE-2026-21714 | Vulnetix

TNCVE-2026-21714 PUBLISHED

Record from tenable · Published March 30, 2026

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

Timeline

Mar 30, 2026 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln TNCVE-2026-21714
vulnetix vdb fixes TNCVE-2026-21714

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/TNCVE-2026-21714/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Tenable: CVE-2026-21714 advisory

Look up in the Resolve Platform →