CVE-2026-123866 Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown
A remote peer can make Node.js HTTP/2 servers leak response memory, including other connections' buffers, to a peer; Node.js HTTP/2 operators should care.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- Available
What is CVE-2026-123866?
CVE-2026-123866 is a high-severity use after free vulnerability in nodejs node, published on 11 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Weakness: CWE-416
Which versions are affected by CVE-2026-123866?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-123866?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-123866 being exploited?
There is no known exploitation of CVE-2026-123866 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-123866, BELL-CVE-2026-123866, DEBIAN-CVE-2026-123866, GHSA-52jx-xggf-7f6v, UBUNTU-CVE-2026-123866.