UBUNTU-CVE-2026-123862: Medium severity ubuntu/nodejs vulnerability
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERRINTERNALASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed to this crash?
An application is affected only if it calls deflate.params() while compressing data in a stream sent to a peer. This is described as uncommon; applications that do not use deflate.params() in that situation are not affected.
What must an attacker do to trigger the issue?
The attacker must be a peer receiving the compressed stream and disconnect while a deflate.params() operation has queued its flush. The disconnect causes the pipeline to destroy the stream before the queued write callback runs, resulting in an uncatchable assertion and process termination.
Can normal stream error handling prevent the process from terminating?
No. The assertion is thrown inside stream internals and bypasses the stream error event, the params() callback, and the pipeline() callback.
Which Node.js release lines are affected?
The affected Node.js release lines are 26.x, 24.x, and 22.x.