Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-04T15:57:24 nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-825

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.

A remote attacker can exploit an Important heap use-after-free vulnerability in Node.js HTTP/2 to crash applications. The flaw, caused by re-entrant memory operations, leads to a denial of service for Red Hat environments with HTTP/2 enabled. Restrict network access to Node.js HTTP/2 listeners to trusted clients only. If HTTP/2 is not required, disable it to remove the vulnerable handler from the attack surface. Red Hat Enterprise Linux 10 Affected nodejs22 Red Hat Enterprise Linux 10 Affected nodejs24 Red Hat Enterprise Linux 8 Affected nodejs Red Hat Enterprise Linux 9 Affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Affected nodejs:24/nodejs Red Hat Hardened Images Not affected nodejs20 Red Hat Hardened Images Not affected nodejs22 Red Hat Hardened Images Not affected nodejs24 Red Hat Hardened Images Not affected nodejs25 Red Hat Hardened Images Not affected nodejs26 https://www.cve.org/CVERecord?id=CVE-2026-56848 https://nvd.nist.gov/vuln/detail/CVE-2026-56848 https://nodejs.org/en/blog/vulnerability/july-2026-security-releases