ALPINE-CVE-2026-123866: Use After Free
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RSTSTREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which Node.js deployments are exposed?
The issue affects Node.js 26.x, 24.x, and 22.x when HTTP/2 streams can be torn down while a response write remains backpressured. The affected Alpine package is alpine/nodejs.
Can an unauthenticated remote peer trigger the issue?
On Node.js 26.x and 24.x, a remote peer can drive the teardown after the window-size change present in 26.9.0 and 24.22.0, such as by sending RST_STREAM. On all supported lines, exploitation is also reachable when the application itself destroys a stream, including through a per-stream idle timeout.
What is the likely impact of successful exploitation?
A peer may receive freed or unrelated heap memory in place of the intended response. This can disclose response-buffer contents associated with other connections; the provided severity vector indicates confidentiality impact without stated integrity or availability impact.