OpenJS Foundation Node.js up to 24.22.2/26.13.0 HTTP 2 stream.respondWithFile/stream.respondWithFD use after free

Summaryinfo

A vulnerability classified as problematic was found in OpenJS Foundation Node.js up to 24.22.2/26.13.0. Impacted is the function stream.respondWithFile/stream.respondWithFD of the component HTTP 2. Executing a manipulation can lead to use after free. This vulnerability is handled as CVE-2026-123874. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in OpenJS Foundation Node.js up to 24.22.2/26.13.0 and classified as problematic. This vulnerability affects the function stream.respondWithFile/stream.respondWithFD of the component HTTP 2. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. As an impact it is known to affect availability. CVE summarizes:

A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).

The advisory is available at nodejs.org. This vulnerability was named CVE-2026-123874 since 11/06/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 24.22.3 or 26.13.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• JavaScript Library

Vendor

• OpenJS Foundation

Name

• Node.js

Version

• 24.22.0
• 24.22.1
• 24.22.2
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6
• 26.7
• 26.8
• 26.9
• 26.10
• 26.11
• 26.12
• 26.13.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion