CVE-2026-123875

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123875", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-11-06T16:22:28.214Z", "datePublished": "2026-11-11T18:33:57.475Z", "dateUpdated": "2026-11-11T18:33:57.475Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-11-11T18:33:57.475Z"}, "title": "Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled", "descriptions": [{"lang": "en", "value": "A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.", "supportingMedia": [{"type": "text/markdown", "base64": false, "value": "A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with `stream.respondWithFile()` or `stream.respondWithFD()` and the client cancels the request, a `StreamPipe` used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}]}], "credits": [{"lang": "en", "value": "Chris Rohlf in collaboration with Claude and Anthropic Research", "type": "reporter"}, {"lang": "en", "value": "mcollina", "type": "remediation developer"}, {"lang": "en", "value": "aduh95", "type": "coordinator"}], "affected": [{"vendor": "nodejs", "product": "node", "defaultStatus": "unaffected", "versions": [{"version": "0.0.0", "status": "affected", "lessThan": "22.23.5", "versionType": "semver"}, {"version": "23.0.0", "status": "affected", "lessThan": "24.22.3", "versionType": "semver"}, {"version": "25.0.0", "status": "affected", "lessThan": "26.13.1", "versionType": "semver"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "NULL Pointer Dereference"}]}], "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases", "tags": ["vendor-advisory"]}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "x_generator": {"engine": "nodejs-private/security-release publish-cves"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThan": "22.23.5", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "24.22.3", "status": "affected", "version": "23.0.0", "versionType": "semver"}, {"lessThan": "26.13.1", "status": "affected", "version": "25.0.0", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}], "id": "CVE-2026-123875", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}, "published": "2026-11-11T19:17:34.697", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "nodejs: nodejs: Denial of Service via cancelled HTTP/2 file downloads", "id": "2571848", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571848"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) by terminating the server process during file transfers. When a client cancels an active file download over an HTTP/2 connection, internal streaming resources are released out of sequence, resulting in an invalid memory access that crashes the application."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123875", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs22", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs24", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs26", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-11T18:33:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123875\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123875\nhttps://cna.openjsf.org/security-advisories.html\nhttps://nodejs.org/en/blog/vulnerability/november-2026-security-releases"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation is restricted to denial of service and requires applications to explicitly implement Node.js HTTP/2 file-serving APIs. Applications not utilizing HTTP/2 servers or those handling file delivery through alternative mechanisms are not affected. While an unauthenticated remote client can trigger an abrupt process crash by prematurely aborting in-flight transfers, confidentiality and system integrity are not compromised.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,22.23.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0,24.22.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.0.0,26.13.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-11-12T13:45:03.647946+00:00", "updated": "2026-11-12T18:30:06.840806+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}