Skip to content

CVE-2026-48937

Named by 3 kept items in this workspace.

Search every workspace for CVE-2026-48937. It matches the name as written, so it can find other things that share it.

The items that name it 3

  • Dependabot vs Renovate
    article2026-09-14It is written here as CVE-2026-48937 (Node.js, fix bundled with a major version bump that removed HTTP/2 priority signaling).

    Node.js, fix bundled with a major version bump that removed HTTP/2 priority signaling

  • What is CVE remediation in 2026?
    article2026-08-21

    Node.js CVE; fix shipped bundled with a SEMVER-MAJOR update to the nghttp2 dependency that removed HTTP/2 priority signaling entirely, so the vulnerable behavior and removed feature came from the same underlying code, forcing users to grep for setPriority and .priority() and strip them before the up

  • The upgrade trap: when upgrading is the wrong answer to a CVE
    article2026-07-22

    Vulnerability in Node.js; fix came bundled with a SEMVER-MAJOR update to the nghttp2 dependency and removal of HTTP/2 priority signaling support, making the security fix inseparable from a breaking change

All cves in this workspace.