EUVD-2026-123701

A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile or respondWithFD. A client can make the server free an Http2Stream while a write request that points to it is still queued on the...