All vulnerabilities
CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerabili

nodejs nodeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.49%Chance of exploitation activity in the next 30 days, higher than 41% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published4 Aug 2026Updated 4 Aug 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 4 Aug 2026, 15:57 UTCPublishedCVE List
  2. 7 Oct 2026, 16:00 UTCExploit code publicMicrosoft Security Blog
  3. 7 Oct 2026, 16:00 UTCFirst reported exploitedMicrosoft Security Blog
  4. NowNot on CISA's known exploited list yet

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Text from CVE List

Affected versions 3

  • nodeaffected: 26.5.0 through 26.5.0CVE List
  • nodeaffected: 24.18.0 through 24.18.0CVE List
  • nodeaffected: 22.23.1 through 22.23.1CVE List

References 1