---
id: "CVE-2026-123875"
page: "https://infrastack.ai/live/CVE-2026-123875"
kind: "vulnerability"
aliases: ["CVE-2026-123875"]
title: "Node.js HTTP/2: cancelled file downloads crash the server process"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["http2", "node.js", "runtime", "self-hosted"]
not_affected_if: ["no-http2-file-serving"]
published_at: "2026-11-11T19:17:34+00:00"
first_seen_at: "2026-11-11T19:28:46+00:00"
updated_at: "2026-11-11T19:30:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123875", "first_seen_at": "2026-11-11T19:28:46+00:00"}]
exploit_sources: []
---

# Node.js HTTP/2: cancelled file downloads crash the server process

Link for people: https://infrastack.ai/live/CVE-2026-123875 (this .md is for agents)

A NULL pointer dereference in Node.js HTTP/2 is triggered when a client cancels a file download served with stream.respondWithFile() or stream.respondWithFD(). The resulting crash aborts the Node.js process, so an unauthenticated client can take the server down with a few cancelled requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `node --version` and compare against the affected lines 26.x, 24.x and 22.x.
- Look for calls to `stream.respondWithFile()` or `stream.respondWithFD()` in HTTP/2 server code.

## Fix

- Node.js 26.x, 24.x and 22.x are affected; the sources do not state the fixed versions.

## Timeline

- 2026-11-11T19:28:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123875

## From the sources

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_