CVE-2026-123875

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...