CVE-2026-123875
Published:November 11, 2026
Updated:November 12, 2026
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Packages
nodejs (CONDA):
Affected version(s) >=22.3.0 <22.23.5Fix Suggestion:
Update to version 22.23.5nodejs (CONDA):
Affected version(s) >=26.0.0 <26.13.1Fix Suggestion:
Update to version 26.13.1nodejs (CONDA):
Affected version(s) >=24.3.0 <24.22.3Fix Suggestion:
Update to version 24.22.3https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v24.0.0 <v24.22.3Fix Suggestion:
Update to version v24.22.3https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v22.0.0 <v22.23.5Fix Suggestion:
Update to version v22.23.5https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v26.0.0 <v26.13.1Fix Suggestion:
Update to version v26.13.1Related Resources (2)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Weakness Type (CWE)
NULL Pointer Dereference
EPSS
Base Score:
0.40