Executive brief
Node.js HTTP/2 handling contains a flaw where internal send operations can be called concurrently during receive operations, leading to heap memory corruption. An attacker can trigger this race condition through specially crafted HTTP/2 requests, causing a server crash or potentially enabling code execution. This affects all active Node.js release lines and impacts the availability and stability of applications using HTTP/2.
Technical details
The vulnerability is a heap-use-after-free (CWE-416) in Node.js HTTP/2 session handling. The root cause is re-entrant calling of `nghttp2_session_mem_send()` while `nghttp2_session_mem_recv()` is executing, creating a race condition that allows memory to be freed and reused improperly. The flaw is reachable via network-based HTTP/2 requests without requiring authentication. An attacker can craft specific HTTP/2 message sequences to trigger concurrent execution paths, leading to memory corruption that can crash the server or enable remote code execution. Patches are available in Node.js 26.x, 24.x, and 22.x release lines.
Affected products
- OpenJS Foundation Node.js 22.x, 24.x, 26.x
Timeline
- 2026-07-29: disclosed: Security release published by Node.js Project
- 2026-08-04: advisory: CVE-2026-56848 published on NVD