CVE-2026-123875 | Node.js up to 22.23.4/24.22.2/26.13.0 HTTP/2 stream.respondWithFile/stream.respondWithFD null pointer dereference

A vulnerability, which was classified as critical, has been found in Node.js up to 22.23.4/24.22.2/26.13.0. The affected element is the function stream.respondWithFile/stream.respondWithFD of the component HTTP2. The manipulation leads to null pointer dereference.

This vulnerability is uniquely identified as CVE-2026-123875. The attack is possible to be carried out remotely. No exploit exists.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More