High severity7.5NVD Advisory· Published Aug 4, 2026· Updated Sep 3, 2026
CVE-2026-56848
CVE-2026-56848
Description
A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
25- osv-coords24 versionspkg:bitnami/nodepkg:bitnami/node-minpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-develpkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweed
< 22.23.2+ 23 more
- (no CPE)range: < 22.23.2
- (no CPE)range: < 22.23.2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 1:22.23.2-1.el10_2
- (no CPE)range: < 3.1.14-2.module_el9.8.0+291+0bb98cce
- (no CPE)range: < 1:10.9.8-1.22.23.2.1.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+227+12323393
- (no CPE)range: < 2021.06-6.module_el9.7.0+227+12323393
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 1:24.19.0-1.el10_2
- (no CPE)range: < 1:11.17.0-1.24.19.0.1.el10_2
- (no CPE)range: < 1:10.9.8-1.22.23.2.1.module_el9.8.0+302+959ebcd4
- (no CPE)range: < 3:12.4.254.21-1.22.23.2.1.module_el9.8.0+302+959ebcd4
- (no CPE)range: < 3:13.6.233.17-1.24.19.0.1.module_el9.8.0+301+084fac05
- (no CPE)range: < 22.23.2-160000.1.1
- (no CPE)range: < 24.18.1-160000.1.1
- (no CPE)range: < 24.18.1-1.1
- (no CPE)range: < 26.5.1-1.1
Patches
Vulnerability mechanics
References
1News mentions
1- Node.js Fixes 11 Security Flaws That Can Crash Servers and Break Filesystem RestrictionsCyber Security News · Jul 30, 2026