CVE-2026-56848

CVE-2026-56848 NVD 설명 Node.js HTTP/2 처리의 결함으로 인해 nghttp2sessionmemrecv가 실행되는 동안 nghttp2sessionmemsend가 재진입 방식으로 호출될 수 있으며, 이로 인해 힙 사용 후 해제heap-use-after-free가 발생합니다. 이 취약점은 Node.js 26.x, 24.x 및 22.x에 영향을 미칩니다. 참고: 설명에 언급된 버전은 업스트림 nodejs 패키지에만 적용되며 Alpine이 배포하는 nodejs 패키지에는 적용되지 않습니다. 릴리스 라인| 취약...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

Node.js: Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

A flaw was discovered in the Node.js HTTP/2 implementation that allowed the nghttp2sessionmemsend function to be called re-entrantly while nghttp2sessionmemrecv was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x...