ALPINE-CVE-2026-123862: Low severity alpine/nodejs vulnerability
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERRINTERNALASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which applications are realistically exposed?
An application is affected only if it calls deflate.params() while compressing data in a stream sent to a peer. This usage is described as uncommon.
What must an attacker do to trigger the crash?
The peer must disconnect while data is being compressed after deflate.params() has queued a flush. The resulting stream destruction can cause an internal assertion that terminates the process.
Can normal stream error handling prevent the termination?
No. The assertion is thrown inside stream internals and bypasses the stream error event, the params() callback, and the pipeline() callback.
Which Node.js release lines are affected?
The issue affects Node.js 26.x, 24.x, and 22.x.