CVE-2026-123874
Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
| CWE | CWE-416 |
| Vendor | nodejs |
| Product | node |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 11, 2026 |
Get instant alerts for nodejs node
Be the first to know when new high vulnerabilities affecting nodejs node are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H