Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-123862
Published:November 11, 2026
Updated:November 12, 2026
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Packages
nodejs (CONDA):
Affected version(s) >=22.3.0 <22.23.5
Fix Suggestion:
Update to version 22.23.5
nodejs (CONDA):
Affected version(s) >=26.0.0 <26.13.1
Fix Suggestion:
Update to version 26.13.1
nodejs (CONDA):
Affected version(s) >=24.3.0 <24.22.3
Fix Suggestion:
Update to version 24.22.3
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v24.0.0 <v24.22.3
Fix Suggestion:
Update to version v24.22.3
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v26.0.0 <v26.13.1
Fix Suggestion:
Update to version v26.13.1
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v22.0.0 <v22.23.5
Fix Suggestion:
Update to version v22.23.5
Do you need more information?
Contact Us
CVSS v4
Base Score:
2.1
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
2.9
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
LOW
Weakness Type (CWE)
Uncaught Exception
EPSS
Base Score:
0.15