NULL Pointer Dereference in Node.js HTTP/2 Features Affects Server Stability
CVE-2026-123875

5.9MEDIUM

Key Information:

Vendor

Nodejs

Status
Node
Vendor
CVE Published:
11 November 2026

What is CVE-2026-123875?

A NULL pointer dereference vulnerability exists in Node.js's handling of HTTP/2 file transfers, allowing unauthorized clients to crash the server by prematurely canceling file download requests. This occurs when the server processes a file using stream.respondWithFile() or stream.respondWithFD(), and the client's cancellation leads to improper teardown sequences of StreamPipe. Such scenarios can bring down the web server without the need for specially crafted frames or complex exploits, merely requiring several canceled requests directed at a default file-serving handler.

Affected Version(s)

node 0.0.0 < 22.23.5

node 23.0.0 < 24.22.3

node 25.0.0 < 26.13.1

References

https://nodejs.org/en/blog/vulnerability/november-2026-se...
vendor-advisory
https://cna.openjsf.org/security-advisories.html

CVSS V3.0

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chris Rohlf in collaboration with Claude and Anthropic Research
mcollina
aduh95
.