{"affected":[{"defaultStatus":"unaffected","product":"node","source":"CNA: openjs","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-123875","cwes":["CWE-476"],"description":"A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: openjs","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"}],"modifiedAt":1794422037475,"publishedAt":1794422037475,"references":[{"source":"CNA: openjs","tags":["vendor-advisory"],"url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"},{"source":"CNA: openjs","tags":[],"url":"https://cna.openjsf.org/security-advisories.html"}],"remediation":[],"revision":"c16ede36413747ad16411376501470aefdb219f936d077ae42f381001daec222","sources":[{"modifiedAt":1794422037475,"name":"CNA: openjs","retrievedAt":1794424119506,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123875"}],"ssvc":null,"status":"published","title":"Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled","updatedAt":1794424119506}