A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS
    1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-
    certificate policies per hostname, for example stricter admin-only client-cert auth on one host and
    ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the
    TLS 1.2 connection under a different servername and carry its existing authentication to the protected
    host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123872)

  - A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server,
    over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated
    header buffers to outlive its session: the stream is removed from the session's stream set but never
    detached, so when ~Http2Session() runs the memory accounting is nonzero and the
    CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a
    default http2 server whose handler responds before the request body has ended, which is typical. It is a
    variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still
    tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
    (CVE-2026-123863)

  - A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both
    TLS and cleartext, by cancelling file downloads. When the server serves a file with
    stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used
    for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting
    the process. No crafted frames are needed, and a handful of cancelled requests against a default file-
    serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123875)

  - An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a
    peer triggers a protocol error, for example an oversized frame header, while the session is already
    shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling
    session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in
    memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by
    sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case
    of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not
    shutting down, but missed terminations that arrive while the session is already shutting down. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123865)

  - A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker
    corrupt process memory. When an application passes an attacker-controlled value such as a request's
    :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a
    buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end
    of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-
    of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This
    vulnerability affects Node.js 26.x and 24.x. (CVE-2026-123828)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794437289 advisory.

  - A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of     other connections' response buffers, to a peer. When a stream is torn down while a write is still     backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the     stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated     heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the     teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is     present, and on all supported lines the same defect is reachable through an application-initiated teardown     such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123866)

  - An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a     peer triggers a protocol error, for example an oversized frame header, while the session is already     shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling     session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in     memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by     sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case     of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not     shutting down, but missed terminations that arrive while the session is already shutting down. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123865)

  - A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server,     over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated     header buffers to outlive its session: the stream is removed from the session's stream set but never     detached, so when ~Http2Session() runs the memory accounting is nonzero and the     CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a     default http2 server whose handler responds before the request body has ended, which is typical. It is a     variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still     tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
    (CVE-2026-123863)

  - A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other     connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut()     directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP     parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-     entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then     copies that freed or unrelated heap memory into the response for the request body. Triggering it requires     a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-     empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request     body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794436852 advisory.

  - A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of     other connections' response buffers, to a peer. When a stream is torn down while a write is still     backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the     stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated     heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the     teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is     present, and on all supported lines the same defect is reachable through an application-initiated teardown     such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123866)

  - An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a     peer triggers a protocol error, for example an oversized frame header, while the session is already     shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling     session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in     memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by     sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case     of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not     shutting down, but missed terminations that arrive while the session is already shutting down. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123865)

  - A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server,     over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated     header buffers to outlive its session: the stream is removed from the session's stream set but never     detached, so when ~Http2Session() runs the memory accounting is nonzero and the     CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a     default http2 server whose handler responds before the request body has ended, which is typical. It is a     variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still     tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
    (CVE-2026-123863)

  - A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other     connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut()     directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP     parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-     entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then     copies that freed or unrelated heap memory into the response for the request body. Triggering it requires     a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-     empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request     body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794437289 advisory.

  - A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of     other connections' response buffers, to a peer. When a stream is torn down while a write is still     backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the     stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated     heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the     teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is     present, and on all supported lines the same defect is reachable through an application-initiated teardown     such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123866)

  - An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a     peer triggers a protocol error, for example an oversized frame header, while the session is already     shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling     session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in     memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by     sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case     of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not     shutting down, but missed terminations that arrive while the session is already shutting down. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123865)

  - A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server,     over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated     header buffers to outlive its session: the stream is removed from the session's stream set but never     detached, so when ~Http2Session() runs the memory accounting is nonzero and the     CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a     default http2 server whose handler responds before the request body has ended, which is typical. It is a     variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still     tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
    (CVE-2026-123863)

  - A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other     connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut()     directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP     parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-     entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then     copies that freed or unrelated heap memory into the response for the request body. Triggering it requires     a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-     empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request     body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
479025	Alpine: nodejs: security update to 22.23.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
479025	Alpine: nodejs: security update to 22.23.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
479024	Alpine: nodejs: security update to 24.22.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
479024	Alpine: nodejs: security update to 24.22.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
379350	Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794437289)	Nessus	Rocky Linux Local Security Checks	Local	high
379346	AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1794436852)	Nessus	Alma Linux Local Security Checks	Local	high
379344	AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794437289)	Nessus	Alma Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-123866

high

Tenable Plugins

high

high

high

high

high

high

high