[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-56846":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":86,"aliases":87,"duplicate_of":9,"upstream":93,"downstream":94,"duplicates":147,"related":148,"reserved_at":9,"published_at":164,"modified_at":165,"state":166,"summary":167,"references_raw":176,"kevs":207,"epss":208,"epss_history":211,"metrics":352,"affected":366},"CVE-2026-56846","A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\r\n\r\nThis vulnerability affects Node.js **24.x** and **22.x**.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-400","Uncontrolled Resource Consumption","The product does not properly control the allocation and maintenance of a limited resource.","weakness","Draft","Class","High",[20,24,82],{"id":21,"name":22,"techniques":23},"CAPEC-147","XML Ping of the Death",[],{"id":25,"name":26,"techniques":27},"CAPEC-227","Sustained Client Engagement",[28],{"id":29,"name":30,"tactics":31,"countermeasures":35},"T1499","Endpoint Denial of Service",[32],{"id":33,"name":34},"TA0105","Impact",[36,41,45,49,53,57,61,66,70,74,78],{"id":37,"name":38,"tactic":39},"D3-ISVA","Inbound Session Volume Analysis",{"name":40},"Detect",{"id":42,"name":43,"tactic":44},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":40},{"id":46,"name":47,"tactic":48},"D3-APCA","Application Protocol Command Analysis",{"name":40},{"id":50,"name":51,"tactic":52},"D3-NTCD","Network Traffic Community Deviation",{"name":40},{"id":54,"name":55,"tactic":56},"D3-RTSD","Remote Terminal Session Detection",{"name":40},{"id":58,"name":59,"tactic":60},"D3-CSPP","Client-server Payload Profiling",{"name":40},{"id":62,"name":63,"tactic":64},"D3-NTF","Network Traffic Filtering",{"name":65},"Isolate",{"id":67,"name":68,"tactic":69},"D3-ITF","Inbound Traffic Filtering",{"name":65},{"id":71,"name":72,"tactic":73},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":40},{"id":75,"name":76,"tactic":77},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":40},{"id":79,"name":80,"tactic":81},"D3-NTSA","Network Traffic Signature Analysis",{"name":40},{"id":83,"name":84,"techniques":85},"CAPEC-492","Regular Expression Exponential Blowup",[],[],[88,89,90,91,92],"ALPINE-CVE-2026-56846","UBUNTU-CVE-2026-56846","DEBIAN-CVE-2026-56846","CGA-844v-m8hv-v8vw","CGA-p4mg-qq7m-wv6w",[],[95,97,99,101,103,105,107,109,111,113,115,117,119,121,123,125,127,129,131,133,135,137,139,141,143,145],{"_key":96},"SUSE-SU-2026:3520-1",{"_key":98},"SUSE-SU-2026:3521-1",{"_key":100},"SUSE-SU-2026:3557-1",{"_key":102},"OPENSUSE-SU-2026:11439-1",{"_key":104},"OPENSUSE-SU-2026:11440-1",{"_key":106},"OPENSUSE-SU-2026:21545-1",{"_key":108},"OPENSUSE-SU-2026:21546-1",{"_key":110},"SUSE-SU-2026:23130-1",{"_key":112},"SUSE-SU-2026:23131-1",{"_key":114},"SUSE-SU-2026:23154-1",{"_key":116},"SUSE-SU-2026:23155-1",{"_key":118},"MGASA-2026-0359",{"_key":120},"RHSA-2026:48305",{"_key":122},"RHSA-2026:48537",{"_key":124},"RHSA-2026:61376",{"_key":126},"RHSA-2026:61377",{"_key":128},"RHSA-2026:61383",{"_key":130},"RHSA-2026:61386",{"_key":132},"RHSA-2026:62219",{"_key":134},"RHSA-2026:62583",{"_key":136},"SUSE-SU-2026:3929-1",{"_key":138},"SUSE-SU-2026:3930-1",{"_key":140},"SUSE-SU-2026:4248-1",{"_key":142},"SUSE-SU-2026:4261-1",{"_key":144},"RHSA-2026:62416",{"_key":146},"RHSA-2026:64817",[],[149,150,151,152,153,154,155,156,157,158,159,160,161,162,163],{"_key":96},{"_key":98},{"_key":100},{"_key":102},{"_key":104},{"_key":106},{"_key":108},{"_key":110},{"_key":112},{"_key":114},{"_key":116},{"_key":136},{"_key":138},{"_key":140},{"_key":142},"2026-08-04T00:49:58.319Z","2026-08-04T15:03:38.709Z","Awaiting Analysis",{"cisa_kev":168,"cisa_ransomware":168,"cisa_vendor":9,"epss_severity":169,"epss_score":170,"severity":171,"severity_score":172,"severity_version":173,"severity_source":174,"severity_vector":175,"severity_status":166},false,"low",0.005,"high",7.5,"v3.0","cve.org","CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[177,182,188,194,198,202],{"url":178,"sources":179,"tags":181},"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",[174,180],"nvd",[],{"url":183,"sources":184,"tags":186},"https://security.alpinelinux.org/vuln/CVE-2026-56846",[185],"osv_alpine",[187],"Advisory",{"url":189,"sources":190,"tags":192},"https://ubuntu.com/security/CVE-2026-56846",[191],"osv_ubuntu",[193],"REPORT",{"url":195,"sources":196,"tags":197},"https://www.cve.org/CVERecord?id=CVE-2026-56846",[191],[193],{"url":199,"sources":200,"tags":201},"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-retained-headers-can-bypass-maxsessionmemory-limits-cve-2026-56846---high",[191],[193],{"url":203,"sources":204,"tags":206},"https://security-tracker.debian.org/tracker/CVE-2026-56846",[205],"osv_debian",[187],[],{"date":209,"score":170,"percentile":210},"2026-09-19",0.41829,[212,216,219,222,225,228,232,235,238,241,244,247,250,253,255,258,261,264,267,270,273,276,279,282,285,288,291,294,297,300,303,306,309,312,315,318,321,324,327,330,333,336,339,342,345,348,351],{"date":213,"score":214,"percentile":215},"2026-08-04",0.00548,0.42832,{"date":217,"score":214,"percentile":218},"2026-08-05",0.42822,{"date":220,"score":214,"percentile":221},"2026-08-06",0.42858,{"date":223,"score":214,"percentile":224},"2026-08-07",0.42905,{"date":226,"score":214,"percentile":227},"2026-08-08",0.42911,{"date":229,"score":230,"percentile":231},"2026-08-09",0.00623,0.46533,{"date":233,"score":230,"percentile":234},"2026-08-10",0.46538,{"date":236,"score":230,"percentile":237},"2026-08-11",0.46619,{"date":239,"score":230,"percentile":240},"2026-08-12",0.46713,{"date":242,"score":230,"percentile":243},"2026-08-13",0.46757,{"date":245,"score":230,"percentile":246},"2026-08-14",0.46828,{"date":248,"score":230,"percentile":249},"2026-08-15",0.46944,{"date":251,"score":230,"percentile":252},"2026-08-16",0.46967,{"date":254,"score":230,"percentile":249},"2026-08-17",{"date":256,"score":230,"percentile":257},"2026-08-18",0.46969,{"date":259,"score":230,"percentile":260},"2026-08-19",0.47168,{"date":262,"score":230,"percentile":263},"2026-08-20",0.47231,{"date":265,"score":230,"percentile":266},"2026-08-21",0.47279,{"date":268,"score":230,"percentile":269},"2026-08-22",0.47298,{"date":271,"score":230,"percentile":272},"2026-08-23",0.47022,{"date":274,"score":170,"percentile":275},"2026-08-24",0.40505,{"date":277,"score":170,"percentile":278},"2026-08-25",0.4054,{"date":280,"score":170,"percentile":281},"2026-08-26",0.40633,{"date":283,"score":170,"percentile":284},"2026-08-27",0.40679,{"date":286,"score":170,"percentile":287},"2026-08-28",0.40601,{"date":289,"score":170,"percentile":290},"2026-08-29",0.40639,{"date":292,"score":170,"percentile":293},"2026-08-30",0.40769,{"date":295,"score":170,"percentile":296},"2026-08-31",0.40778,{"date":298,"score":170,"percentile":299},"2026-09-01",0.4081,{"date":301,"score":170,"percentile":302},"2026-09-02",0.40861,{"date":304,"score":170,"percentile":305},"2026-09-03",0.40886,{"date":307,"score":170,"percentile":308},"2026-09-04",0.40931,{"date":310,"score":170,"percentile":311},"2026-09-05",0.40862,{"date":313,"score":170,"percentile":314},"2026-09-06",0.41,{"date":316,"score":170,"percentile":317},"2026-09-07",0.41007,{"date":319,"score":170,"percentile":320},"2026-09-08",0.41028,{"date":322,"score":170,"percentile":323},"2026-09-09",0.41177,{"date":325,"score":170,"percentile":326},"2026-09-10",0.4121,{"date":328,"score":170,"percentile":329},"2026-09-11",0.41243,{"date":331,"score":170,"percentile":332},"2026-09-12",0.41332,{"date":334,"score":170,"percentile":335},"2026-09-13",0.41298,{"date":337,"score":170,"percentile":338},"2026-09-14",0.41325,{"date":340,"score":170,"percentile":341},"2026-09-15",0.41397,{"date":343,"score":170,"percentile":344},"2026-09-16",0.41586,{"date":346,"score":170,"percentile":347},"2026-09-17",0.4166,{"date":349,"score":170,"percentile":350},"2026-09-18",0.41799,{"date":209,"score":170,"percentile":210},[353,358,360,362,364],{"source":174,"cvss_v2_0":9,"cvss_v3_0":354,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":172,"baseSeverity":355,"vectorString":175,"impactScore":356,"exploitabilityScore":357},"HIGH",6,10,{"source":180,"cvss_v2_0":9,"cvss_v3_0":359,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":172,"baseSeverity":355,"vectorString":175,"impactScore":356,"exploitabilityScore":357},{"source":185,"cvss_v2_0":9,"cvss_v3_0":361,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":172,"baseSeverity":9,"vectorString":175,"impactScore":356,"exploitabilityScore":357},{"source":191,"cvss_v2_0":9,"cvss_v3_0":363,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":172,"baseSeverity":9,"vectorString":175,"impactScore":356,"exploitabilityScore":357},{"source":205,"cvss_v2_0":9,"cvss_v3_0":365,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":172,"baseSeverity":9,"vectorString":175,"impactScore":356,"exploitabilityScore":357},[367,384,391,396,408,415],{"ecosystem":368,"name":369,"vendor":370,"product":369,"cpe_part":9,"purl_type":371,"purl_namespace":370,"purl_name":369,"source":9,"versions":372},"Alpine Linux","nodejs","alpine","apk",[373,379,380,383],{"version":374,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":377,"version_end_type":378,"fixed_in":9},"lt22_23_2_r0",true,"ecosystem","22.23.2-r0","excluding",{"version":374,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":377,"version_end_type":378,"fixed_in":9},{"version":381,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":382,"version_end_type":378,"fixed_in":9},"lt24_18_1_r0","24.18.1-r0",{"version":381,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":382,"version_end_type":378,"fixed_in":9},{"ecosystem":385,"name":386,"vendor":387,"product":386,"cpe_part":9,"purl_type":371,"purl_namespace":387,"purl_name":386,"source":9,"versions":388},"Chainguard","nodejs-20","chainguard",[389],{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"ecosystem":392,"name":386,"vendor":393,"product":386,"cpe_part":9,"purl_type":371,"purl_namespace":393,"purl_name":386,"source":9,"versions":394},"Wolfi","wolfi",[395],{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":397,"name":369,"vendor":398,"product":369,"cpe_part":9,"purl_type":399,"purl_namespace":398,"purl_name":369,"source":9,"versions":400},"Debian","debian","deb",[401,402,403,404,405],{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":406,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":407,"version_end_type":378,"fixed_in":9},"lt24_19_0+dfsg+~cs24_13_3_1","24.19.0+dfsg+~cs24.13.3-1",{"ecosystem":409,"name":369,"vendor":410,"product":369,"cpe_part":9,"purl_type":399,"purl_namespace":410,"purl_name":369,"source":9,"versions":411},"Ubuntu","ubuntu",[412,413,414],{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":390,"is_range":375,"range_type":376,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":416,"vendor":369,"product":416,"cpe_part":417,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":418},"node","a",[419,423],{"version":420,"is_range":375,"range_type":174,"version_start":421,"version_start_type":422,"version_end":421,"version_end_type":422,"fixed_in":9},">= 24.18.0, \u003C= 24.18.0","24.18.0","including",{"version":424,"is_range":375,"range_type":174,"version_start":425,"version_start_type":422,"version_end":425,"version_end_type":422,"fixed_in":9},">= 22.23.1, \u003C= 22.23.1","22.23.1"]