Skip to main content

Node.js CVE-2026-56848

| EUVDEUVD-2026-52763 HIGH
Use After Free (CWE-416)
2026-07-29 GHSA-679w-638g-xf9h
Information Disclosure Use After Free Memory Corruption
7.5
CVSS 3.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable UAF triggered by unauthenticated HTTP/2 frames; impact is crash-only per CVSS C:N/I:N, with high availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 04, 2026 - 17:26 vuln.today
Analysis Generated
Aug 04, 2026 - 17:26 vuln.today
CVE Published
Jul 29, 2026 - 14:02 github-releases
UNKNOWN (no severity yet)
CVE Published
Jul 29, 2026 - 14:02 github-releases
HIGH 7.5

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Use-after-free in Node.js HTTP/2 implementation allows remote unauthenticated attackers to crash the Node.js process by sending crafted HTTP/2 RST_STREAM frames while the stream object remains in scope. The fix - 'defer rst stream while in scope' - confirms that RST_STREAM processing freed or invalidated memory still referenced by the active stream context. With CVSS A:H and AV:N/AC:L/PR:N/UI:N, this is a straightforward remote denial-of-service against any Node.js server with HTTP/2 enabled. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and multi-LTS-branch impact make patching urgent.

Technical ContextAI

CWE-416 (Use After Free) in the HTTP/2 subsystem: the Node.js HTTP/2 stack (powered internally by nghttp2) was sending or processing RST_STREAM frames before the associated stream object went out of scope, creating a temporal memory safety violation. When a stream is reset while still referenced, subsequent accesses to the freed stream structure produce undefined behavior - typically a crash (SIGSEGV or assertion failure), which manifests as process termination and a denial of service. The commit message 'defer rst stream while in scope' confirms the fix defers RST processing until safe. Affected CPE covers Node.js 22.x (≤22.23.1 LTS), 24.x (≤24.18.0 LTS), and 26.x (≤26.5.0 Current). Tags additionally indicate Memory Corruption and Information Disclosure potential - UAF conditions can in theory leak freed heap content before crashing, though the CVSS vector assigns C:N, suggesting the vendor's primary characterization is DoS.

RemediationAI

Upgrade to Node.js 26.5.1 or the corresponding patched LTS releases for the 22.x and 24.x lines, as published in the July 2026 security release at https://nodejs.org/en/blog/vulnerability/july-2026-security-releases. The patch was authored by Matteo Collina and defers RST_STREAM processing until the stream is safely out of scope. If immediate upgrade is not possible, the primary compensating control is to disable HTTP/2 and fall back to HTTP/1.1 by replacing http2.createServer/createSecureServer with https.createServer - this eliminates the vulnerable code path entirely but forfeits HTTP/2 performance benefits (multiplexing, header compression). Placing an HTTP/2-capable reverse proxy (nginx, Envoy, HAProxy) in front of the Node.js server and terminating HTTP/2 at the proxy while forwarding HTTP/1.1 to the backend is a practical interim mitigation that preserves client-facing HTTP/2 without exposing the vulnerable Node.js HTTP/2 stack. Network-layer filtering of HTTP/2 traffic from untrusted clients is a last-resort option but impractical for public APIs.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-56848 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy