Node.js HTTP/2 Heap Use-After-Free

Repository is a standalone JavaScript proof-of-concept for CVE-2026-56848, a Node.js HTTP/2 heap-use-after-free caused by re-entrant nghttp2 send during receive. The repo contains: (1) exploit.js, the main exploit client; (2) server.js, a minimal vulnerable HTTP/2 target for local reproduction; (3) Dockerfile, which builds Node.js v22.23.1 with AddressSanitizer and runs server.js on port 8000; plus README documentation and ignore files. The exploit capability is remote, unauthenticated denial of service against vulnerable Node.js HTTP/2 servers. exploit.js uses raw TCP sockets rather than Node's high-level HTTP/2 client so it can precisely control frame ordering and packetization. It sends the HTTP/2 client preface and SETTINGS, waits for the server SETTINGS, acknowledges them, opens stream 1, then sends in one corked write a GOAWAY frame followed by HEADERS for new odd-numbered streams (3, 5, 7, ...). This is designed so the server processes GOAWAY and subsequent refused streams inside a single nghttp2_session_mem_recv() call, causing SubmitRstStream(REFUSED_STREAM) to call SendPendingData() re-entrantly and trigger the use-after-free. The script supports configurable host, port, iteration count, number of refused streams, and settle timeout, and logs any RST_STREAM frames returned. server.js is not malicious payload code; it is a minimal local target that starts an h2c server and intentionally does almost nothing at the application layer because the bug is triggered during frame processing before normal request handling. The Dockerfile operationalizes testing by compiling a vulnerable ASan-instrumented Node.js binary from source and exposing port 8000, making crashes deterministic and easy to observe. Overall, this is a real exploit PoC rather than a detector. It does not provide code execution or persistence; its practical effect is crashing vulnerable Node.js HTTP/2 services through crafted network traffic.