CVE-2026-56848: Node.js HTTP/2 Use-After-Free Vulnerability

CVE-2026-56848 Overview

CVE-2026-56848 is a heap use-after-free vulnerability [CWE-416] in the Node.js HTTP/2 implementation. The flaw allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is still executing. This re-entrant invocation triggers access to freed heap memory during HTTP/2 session processing.

The vulnerability affects Node.js 26.x, 24.x, and 22.x release lines. A network-based attacker can exploit the flaw without authentication or user interaction. The primary impact is availability loss on affected Node.js servers processing HTTP/2 traffic.

Critical Impact
Remote unauthenticated attackers can trigger a heap use-after-free in Node.js HTTP/2 handling, causing process crashes and denial of service on exposed Node.js services.

Affected Products

Node.js 26.x release line
Node.js 24.x release line
Node.js 22.x release line

Discovery Timeline

2026-08-04 - CVE CVE-2026-56848 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-56848

Vulnerability Analysis

The vulnerability resides in Node.js HTTP/2 session handling, which wraps the nghttp2 library. Node.js exposes two core session functions: nghttp2_session_mem_recv() for processing incoming HTTP/2 frames and nghttp2_session_mem_send() for producing outgoing frames. These functions must not overlap on the same session object.

Under specific conditions, nghttp2_session_mem_send() executes re-entrantly while nghttp2_session_mem_recv() has not yet returned. The re-entrant call operates on session state that the outer mem_recv invocation has already freed or is about to reuse. Subsequent memory accesses read or write freed heap chunks, yielding a use-after-free condition [CWE-416].

The issue is classified as a memory-safety defect in the HTTP/2 protocol layer. Impact is limited to availability; the vector does not report confidentiality or integrity effects. Refer to the Node.js July 2026 Security Blog for the vendor's technical description.

Root Cause

The root cause is unsafe re-entrancy in the HTTP/2 session callback chain. Node.js callbacks invoked from within nghttp2_session_mem_recv() can trigger a send path that calls nghttp2_session_mem_send() before the receive routine unwinds. The session's internal buffers and stream structures are not stable during this window.

Attack Vector

An attacker sends crafted HTTP/2 frames to a Node.js server or client that terminates HTTP/2 connections. The frame sequence induces a callback pattern that re-enters the send path during receive processing. Successful exploitation dereferences freed memory, crashing the Node.js process and denying service to legitimate clients.

No authentication or user interaction is required. Any Node.js application accepting HTTP/2 traffic on affected releases is exposed. See the Node.js July 2026 Security Blog for further protocol-level details.

Detection Methods for CVE-2026-56848

Indicators of Compromise

Unexpected termination or crash logs from Node.js processes with SIGSEGV or SIGABRT signals during HTTP/2 traffic handling.
Repeated short-lived HTTP/2 connections from a single source followed by process restart events via pm2, systemd, or container orchestrator logs.
Heap corruption traces or nghttp2 symbols appearing in Node.js crash dumps and core files.

Detection Strategies

Inventory Node.js runtimes across servers and containers, and flag any instance on 22.x, 24.x, or 26.x below the patched releases.
Monitor HTTP/2 endpoints for anomalous frame patterns, malformed streams, or high rates of RST_STREAM and GOAWAY frames preceding crashes.
Correlate Node.js process restart events with inbound HTTP/2 connection metadata to identify targeted exploitation attempts.

Monitoring Recommendations

Enable core dump capture on Node.js hosts and forward crash telemetry to a central SIEM for correlation.
Alert on repeated Node.js process exits within short time windows behind load balancers terminating HTTP/2.
Track outbound HTTP/2 client connections from Node.js workers that may also invoke the vulnerable code path.

How to Mitigate CVE-2026-56848

Immediate Actions Required

Upgrade Node.js to the patched releases published in the Node.js July 2026 Security Blog for the 22.x, 24.x, and 26.x lines.
Restart all long-running Node.js services and container images after applying the update to ensure the vulnerable binaries are no longer loaded.
Rebuild container base images and CI/CD pipelines that pin affected Node.js versions.

Patch Information

The Node.js project released fixed builds for the 22.x, 24.x, and 26.x lines. Consult the Node.js July 2026 Security Blog for the exact patched version numbers and download artifacts. Verify the runtime version with node --version after deployment.

Workarounds

Disable HTTP/2 on Node.js services where feasible by removing http2 server initialization or forcing HTTP/1.1 at the application layer.
Terminate HTTP/2 at an upstream reverse proxy such as nginx or a hardened load balancer, and proxy HTTP/1.1 to the Node.js backend until patches are applied.
Apply rate limiting and connection quotas on HTTP/2 endpoints to reduce the exploitation window.

bash

# Verify Node.js runtime version after patching
node --version

# Example: disable HTTP/2 by terminating at nginx and proxying HTTP/1.1
# nginx.conf snippet
# listen 443 ssl http2;   # remove http2 token to disable
# proxy_pass http://nodejs_backend;
# proxy_http_version 1.1;