DEBIAN-CVE-2026-123875: Null Pointer Dereference
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js servers using HTTP/2 file-serving handlers that call stream.respondWithFile() or stream.respondWithFD() are exposed. The issue can be triggered over both TLS and cleartext HTTP/2 connections.
What does an attacker need to do to cause the crash?
The attacker does not need authentication, user interaction, or crafted HTTP/2 frames. They need to request a served file and cancel the request; a handful of cancelled requests against a default file-serving handler is sufficient.
How can I determine whether an application is affected?
Check whether it runs a Node.js 22.x, 24.x, or 26.x release and serves files through HTTP/2 using stream.respondWithFile() or stream.respondWithFD(). Affected applications abort the Node.js process when a client cancels one of these file-download requests.