UBUNTU-CVE-2026-123874: Use After Free
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js HTTP/2 servers in the affected 26.x line since 26.9.0 or 24.x line since 24.22.0 are exposed when an application uses stream.respondWithFile() or stream.respondWithFD() to serve files. Both TLS-protected and cleartext HTTP/2 connections are affected.
Does exploitation require authentication or non-default HTTP/2 settings?
No. An unauthenticated client can trigger the issue, and no configuration changes beyond an application serving a file through respondWithFile() or respondWithFD() are required.
What application behavior enables the vulnerable code path?
The application must serve a file using stream.respondWithFile() or stream.respondWithFD(). The client can then cause an Http2Stream to be freed while a write referencing that stream remains queued on the socket.