ALPINE-CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

Reentrant Call Vulnerability in ExpressCallHandler Contract

Lines of code Vulnerability details DISCRIPTION The ExpressCallHandler contract contains a potential bug related to handling the express calls. The issue lies in the setExpressReceiveToken and setExpressReceiveTokenWithData functions. Specifically, these functions don't properly handle reentrant...