ALPINE-CVE-2026-123875: Null Pointer Dereference
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js 26.x, 24.x, and 22.x deployments are affected when they serve files over HTTP/2 using stream.respondWithFile() or stream.respondWithFD(). The issue applies to both TLS-protected and cleartext HTTP/2 connections.
What must an attacker do to trigger the crash?
An unauthenticated client only needs to cancel requests while a vulnerable file transfer is in progress. No crafted HTTP/2 frames are required, and a handful of cancelled requests against a default file-serving handler can abort the process.
How can I determine whether my service is at risk?
Check whether the service runs an affected Node.js major version and uses HTTP/2 file responses through stream.respondWithFile() or stream.respondWithFD(). If so, test or monitor for client-cancelled file downloads causing the Node.js process to abort.