Node.js: Use-after-free in HTTP/2 during respondWithFile() and respondWithFD()
Summary
The built-in HTTP/2 module of Node.js contains a use-after-free flaw that can corrupt server memory. An unauthenticated remote client can trigger it over TLS and cleartext when the application serves files with stream.respondWithFile() or stream.respondWithFD(), using default settings otherwise. The CNA scores it 7.5 (CVSS 3.0) with an availability-only impact, so a crash or denial of service is the main risk, although memory corruption is also described.
Affected
- Node.js 24.x from 24.22.0 (CNA description; the CNA affected range starts at 24.0.0)
- Node.js 26.x from 26.9.0
- Node.js 22.x: unclear; the 22.23.5 release notes list the CVE, but the vendor advisory could not be verified
- Node.js 25.x: end of life, no fix
Fixed in
- Node.js 24.22.3
- Node.js 26.13.1
- Node.js 22.23.5 (listed in release notes, not verified against the vendor advisory)
- Node.js 20.x and 25.x: no fix, end of life
Workaround
No vendor-documented workaround. Updating Node.js is the remedy.
Exploitation
No evidence of exploitation in the wild found at the time of research. No public proof of concept found. Not listed in CISA KEV.
Our recommendation
- Inventory all Node.js hosts, including 22.x, 24.x, 26.x and end-of-life versions.
- Update to 24.22.3, 26.13.1 or 22.23.5 depending on the release line, together with the other November 2026 Node.js security fixes.
- Prioritise hosts that serve files over HTTP/2 with respondWithFile() or respondWithFD().
- Check whether internet-facing services reach the Node.js HTTP/2 server directly or only through a reverse proxy.
- Monitor the Node.js security channel and CISA KEV.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA security advisories cna.openjsf.org
- Node.js security releases, 11 November 2026 nodejs.org
- Node.js 24.22.3 release nodejs.org
- Node.js 26.13.1 release nodejs.org
- Node.js 22.23.5 release nodejs.org
- VulDB entry for CVE-2026-123874 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:35.
Original description (NVD)
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.