ALPINE-CVE-2026-123874: Use After Free
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js HTTP/2 servers on affected 26.x releases from 26.9.0 onward or affected 24.x releases from 24.22.0 onward are exposed if the application serves files through stream.respondWithFile() or stream.respondWithFD(). Both TLS and cleartext HTTP/2 deployments are affected.
Does exploitation require authentication or a non-default configuration?
No. An unauthenticated client can trigger the issue, and the stated precondition is only that the application uses stream.respondWithFile() or stream.respondWithFD(); other settings may remain at their defaults.
What capability does an attacker need?
The attacker needs network access to make HTTP/2 requests to the vulnerable server. They can cause a stream to be freed while a socket write referring to that stream remains queued, leading to dereferencing a freed object when the write completes.