{"id":"CVE-2026-123874","kind":"vulnerability","aliases":["CVE-2026-123874"],"related":[],"title":"Node.js: HTTP/2 use-after-free lets unauthenticated clients corrupt server memory","description":"A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).","summary":"A use-after-free in Node.js HTTP/2 lets a client make the server free a stream while a queued write still points to it, then call through the freed object. An unauthenticated attacker can corrupt server memory over TLS or cleartext.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http2","node.js","runtime","self-hosted"],"not_affected_if":["no-respondwithfile","older-node-lines"],"how_to_check":"- Run `node --version` and compare against the affected ranges: 26.x from 26.9.0 and 24.x from 24.22.0.\n- Search application code for `respondWithFile(` or `respondWithFD(` on HTTP/2 streams.","fix":"- Node.js 26.x and 24.x lines: upgrade to a release that includes the fix; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-11T19:17:34+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","triaged_at":"2026-11-11T19:30:07+00:00","updated_at":"2026-11-11T19:30:07+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T19:30:07Z","model":"claude-haiku-5-5","output":{"fix":"- Node.js 26.x and 24.x lines: upgrade to a release that includes the fix; the exact fixed version is unknown from the sources.","reach":"internet","title":"Node.js: HTTP/2 use-after-free lets unauthenticated clients corrupt server memory","impact":"high","summary":"A use-after-free in Node.js HTTP/2 lets a client make the server free a stream while a queued write still points to it, then call through the freed object. An unauthenticated attacker can corrupt server memory over TLS or cleartext.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","http2","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote clients corrupt server memory, possibly enabling code execution.","analyst_note":"Confirm the fixed Node.js versions for the 26.x and 24.x lines from the Node.js security release notes; the sources give only the affected starting versions.","how_to_check":"- Run `node --version` and compare against the affected ranges: 26.x from 26.9.0 and 24.x from 24.22.0.\n- Search application code for `respondWithFile(` or `respondWithFD(` on HTTP/2 streams.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-respondwithfile","older-node-lines"],"who_is_affected":"Servers running Node.js 26.x (from 26.9.0) or 24.x (from 24.22.0) that serve files over HTTP/2 using stream.respondWithFile() or stream.respondWithFD(). Applications that do not call these methods are not exposed under the stated precondition, and the sources say nothing else about configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4669,"output_tokens":630,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123874':15A,18A '-2026':14A,17A '24':162C '24.22.0':165C '26':157C '26.9.0':160C 'affect':155C 'applic':141C 'attack':58B 'call':51B,130C 'cleartext':66B,86C 'client':9A,35B,78C,97C 'code':124C 'complet':122C 'corrupt':10A,60B,79C 'cve':13A,16A 'default':150C 'derefer':125C 'file':91C,144C 'free':6A,29B,39B,71C,102C 'freed':54B,133C 'host':24B 'http/2':2A,32B,74C 'http2':19B 'http2stream':104C 'let':7A,33B,75C 'make':36B,99C,127C 'memori':12A,62B,81C 'node.js':1A,20B,31B,73C,156C 'object':55B,134C 'otherwis':152C 'point':47B,110C 'precondit':137C 'queu':44B,115C 'request':108C 'respondwithfd':95C 'respondwithfil':93C 'runtim':21B 'self':23B 'self-host':22B 'serv':90C,142C 'server':11A,38B,61B,80C,89C,101C 'set':151C 'sinc':159C,164C 'socket':118C 'still':46B,114C 'stream':41B 'stream.respondwithfd':148C 'stream.respondwithfile':146C 'tls':64B,84C 'unauthent':8A,57B,77C 'use':4A,27B,69C 'use-after-fre':3A,26B,68C 'virtual':129C 'vulner':154C 'write':45B,107C,121C 'x':158C,163C","nicknames":[],"mitigations":[],"who_affected":"Servers running Node.js 26.x (from 26.9.0) or 24.x (from 24.22.0) that serve files over HTTP/2 using stream.respondWithFile() or stream.respondWithFD(). Applications that do not call these methods are not exposed under the stated precondition, and the sources say nothing else about configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","http2","nodejs","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123874':15A,18A '-2026':14A,17A 'client':9A 'corrupt':10A 'cve':13A,16A 'free':6A 'http/2':2A 'let':7A 'memori':12A 'node.js':1A 'server':11A 'unauthent':8A 'use':4A 'use-after-fre':3A","search_b":"'attack':58B 'call':51B 'cleartext':66B 'client':35B 'corrupt':60B 'free':29B,39B 'freed':54B 'host':24B 'http/2':32B 'http2':19B 'let':33B 'make':36B 'memori':62B 'node.js':20B,31B 'object':55B 'point':47B 'queu':44B 'runtim':21B 'self':23B 'self-host':22B 'server':38B,61B 'still':46B 'stream':41B 'tls':64B 'unauthent':57B 'use':27B 'use-after-fre':26B 'write':45B","search_c":"'24':162C '24.22.0':165C '26':157C '26.9.0':160C 'affect':155C 'applic':141C 'call':130C 'cleartext':86C 'client':78C,97C 'code':124C 'complet':122C 'corrupt':79C 'default':150C 'derefer':125C 'file':91C,144C 'free':71C,102C 'freed':133C 'http/2':74C 'http2stream':104C 'let':75C 'make':99C,127C 'memori':81C 'node.js':73C,156C 'object':134C 'otherwis':152C 'point':110C 'precondit':137C 'queu':115C 'request':108C 'respondwithfd':95C 'respondwithfil':93C 'serv':90C,142C 'server':80C,89C,101C 'set':151C 'sinc':159C,164C 'socket':118C 'still':114C 'stream.respondwithfd':148C 'stream.respondwithfile':146C 'tls':84C 'unauthent':77C 'use':69C 'use-after-fre':68C 'virtual':129C 'vulner':154C 'write':107C,121C 'x':158C,163C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123874","severity":null,"published_at":"2026-11-11T19:17:34+00:00","modified_at":"2026-11-11T19:17:34+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","fetched_at":"2026-11-11T19:28:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}