Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-123874

Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write

CVSS 3.0 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-123874

Published

A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-123874

Published

node

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "nodejs",
                    "product": "node",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "24.0.0",
                            "status": "affected",
                            "lessThan": "24.22.3",
                            "versionType": "semver"
                        },
                        {
                            "version": "25.0.0",
                            "status": "affected",
                            "lessThan": "26.13.1",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON