# CVE-2026-123874: Node.js HTTP/2 use-after-free in respondWithFile stream reset

Source: https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-123874 · Severity: high · CVSS 7.5 · Published 2026-11-11

Node.js is a runtime environment for server-side JavaScript applications. An unauthenticated remote attacker can crash a Node.js HTTP/2 server or corrupt its memory by resetting a stream while a file write operation is pending. This could lead to server outages or allow an attacker to read sensitive data from the server's memory.

Technologies: [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-123874 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123874 being exploited in the wild.

**How severe is CVE-2026-123874?** High severity, with a CVSS score of 7.5, published 11 November 2026.

**Which products and versions are affected?** OpenJS Foundation Node.js 26.x (26.9.0+), 24.x (24.22.0+).

**Is there a fix for CVE-2026-123874?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123874 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123874?** Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in Node.js HTTP/2 when using respondWithFile() or respondWithFD(). An attacker can trigger the server to free an Http2Stream object while a write request pointing to it remains queued on the socket; when the write completes, the freed object is dereferenced and a virtual call is made through it. The vulnerability requires the application to serve files with respondWithFile() or respondWithFD() with default settings, and affects Node.js 26.x (26.9.0+) and 24.x (24.22.0+) over both TLS and cleartext connections.

## Affected products

- OpenJS Foundation Node.js 26.x (26.9.0+), 24.x (24.22.0+)

## Timeline

- 2026-11-11: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://nodejs.org/en/blog/vulnerability/november-2026-security-releases](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases)

## Related threats

- [Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server)
- [Node.js https.Agent certificate validation bypass via TLS session reuse](https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a)
- [Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an)
- [Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a)
- [Node.js proxy credential disclosure in ERR_PROXY_INVALID_CONFIG](https://junglewise.ai/threats/cve-2026-123871-node-js-discloses-proxy-credentials-in-err-proxy-invalid-config)