CVE-2026-123862
Published:November 11, 2026
Updated:November 12, 2026
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Packages
nodejs (CONDA):
Affected version(s) >=22.3.0 <22.23.5Fix Suggestion:
Update to version 22.23.5nodejs (CONDA):
Affected version(s) >=26.0.0 <26.13.1Fix Suggestion:
Update to version 26.13.1nodejs (CONDA):
Affected version(s) >=24.3.0 <24.22.3Fix Suggestion:
Update to version 24.22.3https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v24.0.0 <v24.22.3Fix Suggestion:
Update to version v24.22.3https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v26.0.0 <v26.13.1Fix Suggestion:
Update to version v26.13.1https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v22.0.0 <v22.23.5Fix Suggestion:
Update to version v22.23.5Related ResourcesĀ (2)
Do you need more information?
Contact UsCVSS v4
Base Score:
2.1
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
2.9
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
LOW
Weakness Type (CWE)
Uncaught Exception
EPSS
Base Score:
0.15