CVE-2026-123874

A use-after-free in Node.js HTTP/2 lets an unauthenticated client corr...

PT-2026-145385

Name of the Vulnerable Software and Affected Versions Node.js versions 24.22.0 through 24.22.2 Node.js versions 26.9.0 through 26.13.0 Description An unauthenticated client can cause a remote denial of service by crashing the server process over TLS or cleartext HTTP/2 connections. This occurs...

Node.js < 24.22.3, < 26.13.1 - Use-After-Free of Http2Stream When a respondWithFile() Stream Is Reset During a Pending Write leading to Remote Memory Corruption

Use-After-Free of Http2Stream When a respondWithFile Stream Is Reset During a Pending Write leading to Remote Memory Corruption vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...