Node.js zlib Streaming API Vulnerability in Node.js by OpenJS Foundation
CVE-2026-123862

2.9LOW

Key Information:

Vendor

Nodejs

Status
Node
Vendor
CVE Published:
11 November 2026

What is CVE-2026-123862?

A flaw in the Node.js zlib streaming API allows a peer to crash a process by disconnecting while data is being compressed. When this occurs, the mechanism fails to handle the state correctly, leading to an internal assertion error. The issue arises specifically when deflate.params() is invoked during streaming operations, creating a potential reliability risk for applications utilizing this feature.

Affected Version(s)

node 0.0.0 < 22.23.5

node 23.0.0 < 24.22.3

node 25.0.0 < 26.13.1

References

https://nodejs.org/en/blog/vulnerability/november-2026-se...
vendor-advisory
https://cna.openjsf.org/security-advisories.html

CVSS V3.0

Score:
2.9
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chris Rohlf in collaboration with Claude and Anthropic Research
mcollina
UlisesGascon
aduh95
.