Back to Vulnerability Directory
HIGHFixed upstream
CVE-2026-56848
Node.js: HTTP/2 re-entrant send causes heap use-after-free
Technology
Node.js
CVSS Score
7.5 / 10.0
Affected Versions
Node.js 22, 24 and 26 before the July 2026 releases
Upstream Fix
22.23.2; 24.18.1; 26.5.1
Published
August 4, 2026
OSSeva Coverage
Fixed upstream
Description
Node.js HTTP/2 handling allowed nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() was executing, resulting in a heap use-after-free. Rated High by Node.js. Fixed in the July 2026 security releases: 22.23.2, 24.18.1 and 26.5.1.
Is your Node.js deployment affected?
If you're running Node.js 22, 24 and 26 before the July 2026 releases, you need this patch. Book a discovery call to get covered.