ALPINE-CVE-2026-123875

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

CVE-2026-123875

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

DEBIAN-CVE-2026-123875

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

EUVD-2026-123705

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

CVE-2026-123875 Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

CVE-2026-123875

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

CVE-2026-123875

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

PT-2026-145423

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...

CVE-2026-123875: nodejs node: A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and…

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile or stream.respondWithFD and the client cancels the request, a StreamPipe used for the...