Node.js HTTP/2: Use-after-free in stream teardown leaks response memory
Summary
A use-after-free in the HTTP/2 stream teardown of Node.js can leak response memory, including data from other connections, to a remote peer. It occurs when a stream is destroyed while a write is still backpressured, for example by a peer RST_STREAM or a per-stream timeout, so freed or unrelated heap memory is sent instead of the intended response. On Node.js 24.x and 26.x a remote peer alone can trigger the flaw, and on all supported lines an application-initiated teardown such as a per-stream idle timeout reaches the same defect.
Affected
- Node.js 22.x before 22.23.5
- Node.js 24.x before 24.22.3
- Node.js 26.x before 26.13.1
Fixed in
- Node.js 22.23.5
- Node.js 24.22.3
- Node.js 26.13.1
Fixed in the Node.js security release of 11 November 2026.
Workaround
Unknown. No workaround is documented in the sources.
- Until patched, limit direct internet exposure of Node.js HTTP/2 listeners, for example with a reverse proxy that terminates HTTP/2. This reduces exposure but is not a verified fix.
Exploitation
- Not known to be exploited.
- No public exploit known.
- The Node.js team reports no attacks so far.
Our recommendation
- Upgrade to Node.js 22.23.5, 24.22.3 or 26.13.1 (or the latest release of these lines) and restart the services.
- Identify servers, containers and build images running Node.js, and check which HTTP/2 listeners are reachable from the internet.
- Monitor for abnormal memory usage and unusual stream resets.
- Replace Node.js lines that are no longer supported, as they receive no fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA Security Advisories cna.openjsf.org
- Node.js Security Releases, 11 November 2026 nodejs.org
- Strix: CVE-2026-123866 www.strix.ai
- OffSeq Radar: CVE-2026-123866 radar.offseq.com
- SecurityOnline: Node.js HTTP/2 and TLS vulnerabilities, November 2026 securityonline.info
- ThreatInt: CVE-2026-123866 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:36.
Original description (NVD)
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.