{"id":"CVE-2026-123875","kind":"vulnerability","aliases":["CVE-2026-123875"],"related":[],"title":"Node.js HTTP/2: cancelled file downloads crash the server process","description":"A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","summary":"A NULL pointer dereference in Node.js HTTP/2 is triggered when a client cancels a file download served with stream.respondWithFile() or stream.respondWithFD(). The resulting crash aborts the Node.js process, so an unauthenticated client can take the server down with a few cancelled requests.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http2","node.js","runtime","self-hosted"],"not_affected_if":["no-http2-file-serving"],"how_to_check":"- Run `node --version` and compare against the affected lines 26.x, 24.x and 22.x.\n- Look for calls to `stream.respondWithFile()` or `stream.respondWithFD()` in HTTP/2 server code.","fix":"- Node.js 26.x, 24.x and 22.x are affected; the sources do not state the fixed versions.","status":"open","published_at":"2026-11-11T19:17:34+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","triaged_at":"2026-11-11T19:30:19+00:00","updated_at":"2026-11-11T19:30:19+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T19:30:19Z","model":"claude-haiku-5-5","output":{"fix":"- Node.js 26.x, 24.x and 22.x are affected; the sources do not state the fixed versions.","reach":"internet","title":"Node.js HTTP/2: cancelled file downloads crash the server process","impact":"low","summary":"A NULL pointer dereference in Node.js HTTP/2 is triggered when a client cancels a file download served with stream.respondWithFile() or stream.respondWithFD(). The resulting crash aborts the Node.js process, so an unauthenticated client can take the server down with a few cancelled requests.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","http2","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated clients crash the Node.js server process repeatedly","analyst_note":"Confirm the fixed Node.js versions for 22.x, 24.x and 26.x from the Node.js security release notes for CVE-2026-123875.","how_to_check":"- Run `node --version` and compare against the affected lines 26.x, 24.x and 22.x.\n- Look for calls to `stream.respondWithFile()` or `stream.respondWithFD()` in HTTP/2 server code.\n- unknown for any exact fixed version: the sources do not state it.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-http2-file-serving"],"who_is_affected":"Servers running Node.js 22.x, 24.x or 26.x that serve files over HTTP/2 with stream.respondWithFile() or stream.respondWithFD() are exposed, over both TLS and cleartext. Servers that do not use HTTP/2 file serving through these calls are not affected by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000786,"input_tokens":4664,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123875':12A,15A '-2026':11A,14A '22':156C '24':153C '26':151C 'abort':46B,124C 'affect':149C 'cancel':3A,34B,62B,84C,100C,136C 'cleartext':82C 'client':33B,53B,74C,99C 'craft':128C 'crash':6A,45B,75C 'cve':10A,13A 'default':140C 'derefer':25B,67C 'dereferenc':123C 'download':5A,37B,86C 'enough':146C 'file':4A,36B,85C,92C,142C 'file-serv':141C 'frame':129C 'hand':134C 'handler':144C 'host':21B 'http/2':2A,28B,70C 'http2':16B 'leav':116C 'let':71C 'need':131C 'node.js':1A,17B,27B,48B,69C,150C 'null':23B,65C,118C 'order':114C 'pointer':24B,66C,119C 'process':9A,49B,126C 'request':63B,102C,137C 'result':44B 'runtim':18B 'self':20B 'self-host':19B 'serv':38B,90C,143C 'server':8A,57B,77C,89C 'stream.respondwithfd':42B,96C 'stream.respondwithfile':40B,94C 'streampip':104C 'take':55B 'tls':80C 'torn':110C 'transfer':108C 'trigger':30B 'unauthent':52B,73C 'use':105C 'vulner':148C 'x':152C,154C,157C","nicknames":[],"mitigations":[],"who_affected":"Servers running Node.js 22.x, 24.x or 26.x that serve files over HTTP/2 with stream.respondWithFile() or stream.respondWithFD() are exposed, over both TLS and cleartext. Servers that do not use HTTP/2 file serving through these calls are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["http2","medium","nodejs","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123875':12A,15A '-2026':11A,14A 'cancel':3A 'crash':6A 'cve':10A,13A 'download':5A 'file':4A 'http/2':2A 'node.js':1A 'process':9A 'server':8A","search_b":"'abort':46B 'cancel':34B,62B 'client':33B,53B 'crash':45B 'derefer':25B 'download':37B 'file':36B 'host':21B 'http/2':28B 'http2':16B 'node.js':17B,27B,48B 'null':23B 'pointer':24B 'process':49B 'request':63B 'result':44B 'runtim':18B 'self':20B 'self-host':19B 'serv':38B 'server':57B 'stream.respondwithfd':42B 'stream.respondwithfile':40B 'take':55B 'trigger':30B 'unauthent':52B","search_c":"'22':156C '24':153C '26':151C 'abort':124C 'affect':149C 'cancel':84C,100C,136C 'cleartext':82C 'client':74C,99C 'craft':128C 'crash':75C 'default':140C 'derefer':67C 'dereferenc':123C 'download':86C 'enough':146C 'file':85C,92C,142C 'file-serv':141C 'frame':129C 'hand':134C 'handler':144C 'http/2':70C 'leav':116C 'let':71C 'need':131C 'node.js':69C,150C 'null':65C,118C 'order':114C 'pointer':66C,119C 'process':126C 'request':102C,137C 'serv':90C,143C 'server':77C,89C 'stream.respondwithfd':96C 'stream.respondwithfile':94C 'streampip':104C 'tls':80C 'torn':110C 'transfer':108C 'unauthent':73C 'use':105C 'vulner':148C 'x':152C,154C,157C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123875","severity":null,"published_at":"2026-11-11T19:17:34+00:00","modified_at":"2026-11-11T19:17:34+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","fetched_at":"2026-11-11T19:28:46+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}