CVE-2026-123875

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

Node.js < 22.23.5, < 24.22.3, < 26.13.1 - NULL Pointer Dereference in StreamPipe Teardown When a respondWithFile() Download Is Cancelled leading to Remote Process Abort

NULL Pointer Dereference in StreamPipe Teardown When a respondWithFile Download Is Cancelled leading to Remote Process Abort vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...