UBUNTU-CVE-2026-123875: Null Pointer Dereference
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js HTTP/2 servers in the affected 22.x, 24.x, and 26.x release lines are exposed when they serve files using stream.respondWithFile() or stream.respondWithFD(). Both TLS-protected and cleartext HTTP/2 connections are affected.
What does an attacker need to do to trigger the issue?
An unauthenticated client only needs to request a file served through one of the affected APIs and cancel the request. No crafted HTTP/2 frames are required, and a handful of cancelled requests can abort the server process.
Is a typical file-serving handler affected?
Yes. A default file-serving handler using stream.respondWithFile() or stream.respondWithFD() is sufficient; the issue does not depend on unusual protocol input or a special TLS configuration.