Use-After-Free Vulnerability in Node.js HTTP/2 Stream Teardown Affecting Multiple Versions

CVE-2026-123866

What is CVE-2026-123866?

A use-after-free vulnerability in Node.js HTTP/2 stream teardown allows for the potential leaking of response memory, which may include sensitive data from other connections' response buffers. This occurs when a response buffer is freed during a stream teardown, yet a reference to it remains, leading to unintentionally writing freed or unrelated heap memory to the socket instead of the intended response. Instances can be triggered either by a remote peer or through application-driven actions, notably in versions 26.x, 24.x, and 22.x.

References