# CVE-2026-123866: Node.js HTTP/2 use-after-free in stream teardown

Source: https://junglewise.ai/threats/cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-123866 · Severity: high · CVSS 7.5 · Published 2026-11-11

Node.js is a server runtime that handles HTTP requests and responses for web applications. A use-after-free flaw in HTTP/2 stream teardown allows a remote attacker to leak sensitive data from the server's memory, including response buffers from other users' connections. This could expose TLS private keys, authentication credentials, or other confidential information to an attacker.

Technologies: [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-123866 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123866 being exploited in the wild.

**How severe is CVE-2026-123866?** High severity, with a CVSS score of 7.5, published 11 November 2026.

**Which products and versions are affected?** OpenJS Foundation Node.js 22.x, 24.x, 26.x.

**Is there a fix for CVE-2026-123866?** Yes: fixed in <UNKNOWN>. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123866 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123866?** Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

## Technical details

A use-after-free vulnerability in HTTP/2 stream teardown occurs when a stream is destroyed while a write operation is still backpressured (e.g., via RST_STREAM or per-stream timeout), causing freed response buffer memory to be written to the socket. On Node.js 26.x and 24.x, this can be triggered remotely by a peer after the window-size change from v26.9.0 and v24.22.0; on all supported lines it is reachable via application-initiated teardown such as idle timeouts. The attacker gains disclosure of freed or unrelated heap memory, potentially including other connections' response contents.

## Affected products

- OpenJS Foundation Node.js 22.x, 24.x, 26.x

## Timeline

- 2026-11-11: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://nodejs.org/en/blog/vulnerability/november-2026-security-releases](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases)

## Related threats

- [Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server)
- [Node.js https.Agent certificate validation bypass via TLS session reuse](https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a)
- [Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an)
- [Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated)
- [Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a)