CVE-2026-49975 (HTTP/2 Bomb): OpenResty needs update to 1.29.8+ to fix vulnerability

Summary

NPM 2.15.1 bundles OpenResty 1.29.2.5 which is vulnerable to CVE-2026-49975 (HTTP/2 Bomb).

Details

A remotely exploitable DoS vulnerability was publicly disclosed on June 3, 2026.
An unauthenticated attacker on a 100Mbps connection can exhaust server memory in seconds
by combining HPACK indexed reference amplification with an HTTP/2 Window Stall.

The fix for nginx shipped in version 1.29.8 via the new max_headers directive.
OpenResty needs to update to a version based on nginx 1.29.8+ for this to be resolved in NPM.

References

• https://github.com/califio/publications/tree/main/MADBugs/http2-bomb
• https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
• https://github.com/openresty/openresty/issues/1128

Current workaround

Setting mem_limit on the Docker container to limit blast radius until a proper fix is available.
http2 off; in Advanced config causes 404 errors due to conflicts with NPM-generated config.

Request

Please update the bundled OpenResty to a version based on nginx 1.29.8+ as soon as it is available upstream.

Start by tracing how NPM 2.15.1 bundles OpenResty, then review the upstream OpenResty issue 1128 and the nginx 1.29.8 change. Done means the bundled OpenResty is based on nginx 1.29.8 or newer and the CVE is resolved without relying on the listed workaround.