CVE-2026-123875 · Runtime
NO FIX YET · SEE WHAT TO DO
A NULL pointer dereference in Node.js HTTP/2 is triggered when a client cancels a file download served with stream.respondWithFile() or stream.respondWithFD(). The resulting crash aborts the Node.js process, so an unauthenticated client can take the server down with a few cancelled requests.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Node.js 22.x, 24.x or 26.x that serve files over HTTP/2 with stream.respondWithFile() or stream.respondWithFD() are exposed, over both TLS and cleartext. Servers that do not use HTTP/2 file serving through these calls are not affected by this description.
Not affected if no-http2-file-serving
Who cares http2, node.js, self-hosted
node --version and compare against the affected lines 26.x, 24.x and 22.x.stream.respondWithFile() or stream.respondWithFD() in HTTP/2 server code.A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.