CVE-2026-56848: Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend() to be called re-entrantly while nghttp2sessionmemrecv() is executing, resulting in a heap-use-after-free.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Other sources
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend() to be called re-entrantly while nghttp2sessionmemrecv() is executing, resulting in a heap-use-after-free.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2Fixed in 24.18.1Fixed in 26.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.5.1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.2-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.18.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.5.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-56848?
The severity of CVE-2026-56848 is rated high with a score of 7.5.
How do I fix CVE-2026-56848?
To fix CVE-2026-56848, upgrade Node.js to a version not affected by this vulnerability.
What impact does CVE-2026-56848 have?
CVE-2026-56848 can lead to a heap-use-after-free condition, which can cause application crashes.
Which Node.js versions are affected by CVE-2026-56848?
CVE-2026-56848 affects Node.js versions 26.x, 24.x, and 22.x.
What kind of vulnerability is CVE-2026-56848?
CVE-2026-56848 is categorized under the use after free vulnerability.