CVE-2026-56848

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
nodejs	node	>= 26.5.0, <= 26.5.0; >= 24.18.0, <= 24.18.0; >= 22.23.1, <= 22.23.1

References

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Timeline

Published: Aug 4, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-56858.8A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The mani CVE-2026-568504.4A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be CVE-2026-568517.5The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.CVE-2026-568527.5A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.CVE-2026-568537.5When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 c CVE-2026-568547.5The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and CVE-2026-568557.5Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. No CVE-2026-568579.8On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory CVE-2026-568586.1Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potenti CVE-2026-568597.5Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.CVE-2026-56868.8A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/CVE-2026-568605.9Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each st