Heap Use-After-Free Vulnerability in Node.js Products

CVE-2026-56848

What is CVE-2026-56848?

A security flaw in Node.js related to HTTP/2 handling presents a re-entrancy issue that allows the nghttp2_session_mem_send() function to be executed while nghttp2_session_mem_recv() is still running. This can lead to a heap use-after-free condition, potentially allowing attackers to exploit memory management errors. Node.js versions 26.x, 24.x, and 22.x are affected, emphasizing the need for prompt updates to maintain system integrity.

References