CVE-2026-56848

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x

Description A flaw in HTTP/2 handling allows the nghttp2 session mem send() function to be called re-entrantly while nghttp2 session mem recv() is executing. This sequence leads to a heap-use-after-free, which occurs when the program continues to use a pointer after the memory it points to has been freed.

Recommendations Update Node.js version 22.x to the latest patched release. Update Node.js version 24.x to the latest patched release. Update Node.js version 26.x to the latest patched release.