{"id":"EM-20261111-SUH6","url":"https://cyber.eventmonitor.net/incident/EM-20261111-SUH6/node-js-http-2-vulnerability-cve-2026-123866/","type":"cve","title":"Node.js HTTP/2 Vulnerability (CVE-2026-123866)","subtitle":"CVE-2026-123866","subject":"CVE-2026-123866","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-11T19:17:33.243Z","firstSignal":"2026-11-11T18:21:18.000Z","lastSignal":"2026-11-11T19:17:33.243Z","updated":"2026-11-12T00:31:06.720Z","revision":1,"life":[{"status":"Born","at":"2026-11-11T19:17:33.243Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-11T19:17:33.243Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-11T18:21:18.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-11T19:17:33.243Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261111-SUH6 created."}],"stages":[{"name":"Disclosed","at":"2026-11-11T19:17:33.243Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-11T19:17:33.243Z","detail":"CVSS 7.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-11T18:21:18.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-11T18:21:18.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-123866 (important)","text":"nodejs: Node.js: Information disclosure via use-after-free during HTTP/2 stream teardown","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-123866.json"},{"at":"2026-11-11T19:17:33.243Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-123866 (CVSS 7.5)","text":"A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123866"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-11T19:17:33.243","score":7.5,"severity":"HIGH","desc":"A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout…","product":"","seen":1794435185345},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}