Use-After-Free Vulnerability in Node.js HTTP/2 Affects Server Memory Management
CVE-2026-123874

7.5HIGH

Key Information:

Vendor

Nodejs

Status
Node
Vendor
CVE Published:
11 November 2026

What is CVE-2026-123874?

A use-after-free vulnerability in Node.js HTTP/2 has been identified, allowing unauthenticated clients to manipulate server memory. This flaw can occur when the server serves files using the methods respondWithFile() or respondWithFD(). An attacker can exploit this vulnerability by keeping a write request queued to an Http2Stream that has already been freed, potentially leading to unintended memory access and exploitation. This issue is present in Node.js versions 26.x from 26.9.0 onward and 24.x from 24.22.0 onward. Immediate attention is required to mitigate risks associated with this vulnerability.

Affected Version(s)

node 24.0.0 < 24.22.3

node 25.0.0 < 26.13.1

References

https://nodejs.org/en/blog/vulnerability/november-2026-se...
vendor-advisory
https://cna.openjsf.org/security-advisories.html

CVSS V3.0

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chris Rohlf in collaboration with Claude and Anthropic Research
mcollina
UlisesGascon
aduh95
.