UpHeron
All vulnerabilities

Servers and applications

CVE-2026-123875

Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled

Severity
Medium 5.9
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
22.23.5, 24.22.3, 26.13.1
Weakness
Null pointer dereference (CWE-476)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Sources
CVE Program

Description

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

From the CVE Program.

Affected software

SoftwareAffected versions
Node.jsServers and applications · cna:nodejs|node
  • From 0.0.0 before 22.23.5
  • From 23.0.0 before 24.22.3
  • From 25.0.0 before 26.13.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-123875