CVE-2026-123875

Node.js versions 26.x, 24.x, and 22.x are vulnerable to a NULL pointer dereference within the HTTP/2 implementation. The flaw occurs when a client cancels a request for a file being served via stream.respondWithFile() or stream.respondWithFD() . This cancellation causes a StreamPipe to be torn do...

CVE-2026-123874

A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile or respondWithFD. A client can make the server free an Http2Stream while a write request that points to it is still queued on the...