CVE-2026-56848: Use After Free
Published Aug 4, 2026
·Updated
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend() to be called re-entrantly while nghttp2sessionmemrecv() is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
1 affected component
Node.js>=22.0.0<=22.x, >=24.0.0<=24.x, >=26.0.0<=26.x
Event History
Aug 4, 2026
CVE Published
via MITRE·03:57 PM
Data Sourced
via MITRE·03:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-56848?
The severity of CVE-2026-56848 is rated high with a score of 7.5.
2
How do I fix CVE-2026-56848?
To fix CVE-2026-56848, upgrade Node.js to a version not affected by this vulnerability.
3
What impact does CVE-2026-56848 have?
CVE-2026-56848 can lead to a heap-use-after-free condition, which can cause application crashes.
4
Which Node.js versions are affected by CVE-2026-56848?
CVE-2026-56848 affects Node.js versions 26.x, 24.x, and 22.x.
5
What kind of vulnerability is CVE-2026-56848?
CVE-2026-56848 is categorized under the use after free vulnerability.