CVE-2026-123875
Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
| CWE | CWE-476 |
| Vendor | nodejs |
| Product | node |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for nodejs node
Be the first to know when new medium vulnerabilities affecting nodejs node are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Versions
nodejs / node
0.0.0 < 22.23.5 23.0.0 < 24.22.3 25.0.0 < 26.13.1
References
Credits
🔍 Chris Rohlf in collaboration with Claude and Anthropic Research mcollina aduh95