CVE-2026-123862 Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() call

An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline does when the peer goes away, Writable...

CVE-2026-123862

Node.js versions 26.x, 24.x, and 22.x are vulnerable to a denial of service via an uncatchable exception in the zlib streaming API . The issue occurs when a peer disconnects while data is being compressed during a pending deflate.params() call. Because the callback ignores error arguments and ass...