{"id":"CVE-2026-123866","kind":"vulnerability","aliases":["CVE-2026-123866"],"related":[],"title":"Node.js: HTTP/2 stream teardown leaks other connections' response memory to peers","description":"A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","summary":"A use-after-free in Node.js HTTP/2 stream teardown writes freed or unrelated heap memory to the socket when a stream is destroyed during a backpressured write. A remote peer can trigger this with RST_STREAM on Node.js 24.x and 26.x, which can expose other connections' response data.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http2","node.js","runtime","self-hosted"],"not_affected_if":["no-http2"],"how_to_check":"- Run `node --version` and compare against the affected lines 26.x, 24.x and 22.x.\n- Check whether the application serves HTTP/2 (`http2.createServer` or `http2.createSecureServer`).\n- Check whether per-stream timeouts are set that can destroy streams.","fix":"- Node.js 26.x and 24.x: the sources name the window-size change in `26.9.0` and `24.22.0` as the point where remote teardown becomes possible; the fixed releases are not stated in the sources.\n- Node.js 22.x: unknown.","status":"open","published_at":"2026-11-11T19:17:33+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","triaged_at":"2026-11-11T19:30:09+00:00","updated_at":"2026-11-11T19:30:09+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T19:30:09Z","model":"claude-haiku-5-5","output":{"fix":"- Node.js 26.x and 24.x: the sources name the window-size change in `26.9.0` and `24.22.0` as the point where remote teardown becomes possible; the fixed releases are not stated in the sources.\n- Node.js 22.x: unknown.","reach":"internet","title":"Node.js: HTTP/2 stream teardown leaks other connections' response memory to peers","impact":"high","summary":"A use-after-free in Node.js HTTP/2 stream teardown writes freed or unrelated heap memory to the socket when a stream is destroyed during a backpressured write. A remote peer can trigger this with RST_STREAM on Node.js 24.x and 26.x, which can expose other connections' response data.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","http2","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote peer reads freed heap memory and other connections' responses","analyst_note":"Confirm the fixed Node.js versions for 22.x, 24.x and 26.x from the nvd entry or the Node.js security release notes.","how_to_check":"- Run `node --version` and compare against the affected lines 26.x, 24.x and 22.x.\n- Check whether the application serves HTTP/2 (`http2.createServer` or `http2.createSecureServer`).\n- Check whether per-stream timeouts are set that can destroy streams.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-http2"],"who_is_affected":"Servers running Node.js 22.x, 24.x or 26.x that serve HTTP/2 are exposed, since a remote peer can reset streams to trigger the flaw. Applications that never use HTTP/2 in Node.js can skip it. The sources do not say whether managed hosting or proxies in front of Node.js reduce exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000826,"input_tokens":4720,"output_tokens":709,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123866':14A,17A '-2026':13A,16A '22':225C '24':63B,168C,222C '24.22.0':189C '26':66B,165C,220C '26.9.0':187C 'affect':218C 'applic':205C 'application-initi':204C 'backpressur':50B,111C 'buffer':96C,136C 'chang':185C 'connect':7A,72B,94C 'content':91C 'cve':12A,15A 'data':74B 'defect':199C 'destroy':47B,129C 'driven':174C 'exampl':113C 'expos':70B 'free':28B,79C 'freed':35B,138C,148C 'heap':38B,151C 'host':23B 'http/2':2A,31B,82C 'http2':18B 'idl':214C 'includ':89C 'initi':206C 'instead':158C 'intend':161C 'leak':5A,86C 'line':196C 'memori':9A,39B,88C,152C 'node.js':1A,19B,30B,62B,81C,164C,219C 'peer':11A,54B,99C,116C,179C 'per':126C,212C 'per-stream':125C,211C 'present':191C 'pure':175C 'reachabl':201C 'refer':141C 'remot':53B,178C 'respons':8A,73B,87C,95C,135C,162C 'rst':59B,117C 'runtim':20B 'self':22B 'self-host':21B 'server':122C 'size':184C 'socket':42B,157C 'still':110C,145C 'stream':3A,32B,45B,60B,83C,102C,118C,127C,131C,133C,213C 'support':195C 'teardown':4A,33B,84C,171C,207C 'timeout':128C,215C 'torn':104C 'trigger':56B 'unrel':37B,150C 'use':26B,77C,146C 'use-after-fre':25B,76C 'vulner':217C 'window':183C 'window-s':182C 'write':34B,51B,108C 'written':154C 'x':64B,67B,166C,169C,221C,223C,226C","nicknames":[],"mitigations":[],"who_affected":"Servers running Node.js 22.x, 24.x or 26.x that serve HTTP/2 are exposed, since a remote peer can reset streams to trigger the flaw. Applications that never use HTTP/2 in Node.js can skip it. The sources do not say whether managed hosting or proxies in front of Node.js reduce exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","http2","nodejs","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123866':14A,17A '-2026':13A,16A 'connect':7A 'cve':12A,15A 'http/2':2A 'leak':5A 'memori':9A 'node.js':1A 'peer':11A 'respons':8A 'stream':3A 'teardown':4A","search_b":"'24':63B '26':66B 'backpressur':50B 'connect':72B 'data':74B 'destroy':47B 'expos':70B 'free':28B 'freed':35B 'heap':38B 'host':23B 'http/2':31B 'http2':18B 'memori':39B 'node.js':19B,30B,62B 'peer':54B 'remot':53B 'respons':73B 'rst':59B 'runtim':20B 'self':22B 'self-host':21B 'socket':42B 'stream':32B,45B,60B 'teardown':33B 'trigger':56B 'unrel':37B 'use':26B 'use-after-fre':25B 'write':34B,51B 'x':64B,67B","search_c":"'22':225C '24':168C,222C '24.22.0':189C '26':165C,220C '26.9.0':187C 'affect':218C 'applic':205C 'application-initi':204C 'backpressur':111C 'buffer':96C,136C 'chang':185C 'connect':94C 'content':91C 'defect':199C 'destroy':129C 'driven':174C 'exampl':113C 'free':79C 'freed':138C,148C 'heap':151C 'http/2':82C 'idl':214C 'includ':89C 'initi':206C 'instead':158C 'intend':161C 'leak':86C 'line':196C 'memori':88C,152C 'node.js':81C,164C,219C 'peer':99C,116C,179C 'per':126C,212C 'per-stream':125C,211C 'present':191C 'pure':175C 'reachabl':201C 'refer':141C 'remot':178C 'respons':87C,95C,135C,162C 'rst':117C 'server':122C 'size':184C 'socket':157C 'still':110C,145C 'stream':83C,102C,118C,127C,131C,133C,213C 'support':195C 'teardown':84C,171C,207C 'timeout':128C,215C 'torn':104C 'unrel':150C 'use':77C,146C 'use-after-fre':76C 'vulner':217C 'window':183C 'window-s':182C 'write':108C 'written':154C 'x':166C,169C,221C,223C,226C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123866","severity":null,"published_at":"2026-11-11T19:17:33+00:00","modified_at":"2026-11-11T19:17:33+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","fetched_at":"2026-11-11T19:28:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}