UBUNTU-CVE-2026-123866: Use After Free
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RSTSTREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to a peer-driven attack?
Node.js HTTP/2 deployments on the 26.x or 24.x lines are exposed to teardown driven purely by a remote peer when the window-size change from 26.9.0 or 24.22.0 is present. The affected software is Node.js 26.x, 24.x, and 22.x.
Can this occur without a malicious client resetting a stream?
Yes. On all supported affected lines, an application-initiated teardown can reach the defect, including a per-stream idle timeout that destroys a stream while a write remains backpressured.
What information could be disclosed?
A peer may receive freed or unrelated heap memory written to its socket instead of the intended response. This can include contents of response buffers belonging to other connections.