Node.js: NULL pointer dereference in HTTP/2 file download cancellation
Summary
Node.js HTTP/2 servers that send files with stream.respondWithFile() or stream.respondWithFD() can crash when a client cancels the download. The flaw is a NULL pointer dereference caused by the order in which a StreamPipe is torn down, and it affects both TLS and cleartext connections. An unauthenticated remote attacker needs only a few cancelled requests against a default file-serving handler to abort the process, which results in denial of service until the process restarts.
Affected
- Node.js 22.x before 22.23.5
- Node.js 24.x before 24.22.3
- Node.js 26.x before 26.13.1
- Node.js 25.x (end of life, no fix; check nodejs.org)
Fixed in
- Node.js 22.23.5
- Node.js 24.22.3
- Node.js 26.13.1 or later
Workaround
Unknown. The vendor advisory does not state a workaround. Unverified interim measures:
- Check whether the application calls respondWithFile() or respondWithFD().
- Serve static files through a reverse proxy in front of Node.js.
- Run the process under a supervisor that restarts it after a crash.
Exploitation
Not known to be exploited in the wild. VulDB reports that technical details are known but no exploit is available.
Our recommendation
- Inventory all Node.js versions on servers, containers and build images.
- Prioritise internet-facing HTTP/2 services that serve files.
- Upgrade to Node.js 22.23.5, 24.22.3, 26.13.1 or later, after checking the nodejs.org advisory.
- Until the upgrade is done, apply the interim measures above and monitor for repeated process crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA Security Advisories cna.openjsf.org
- Node.js Security Releases, 11 November 2026 nodejs.org
- VulDB CVE-2026-123875 vuldb.com
- Strix CVE-2026-123875 www.strix.ai
- OffSeq Radar CVE-2026-123875 radar.offseq.com
- ThreatInt CVE-2026-123875 cve.threatint.com
- SecurityOnline Node.js HTTP/2 and TLS vulnerabilities, November 2026 securityonline.info
- Node.js pull request 67252 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:43.
Original description (NVD)
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.