HighPublic exploitVulnerability

CVE-2026-56848

Heap-use-after-free in Node.js HTTP/2 handling

Published Aug 4, 2026 · Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

11 mentions · peak 3 in a dayToday

CVSS7.5High · v3

EPSS0.52%44th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

IdentifiersCVE-2026-56848CWE-416 · Use After Free

CVE-2026-56848 is a heap-use-after-free vulnerability in Node.js HTTP/2 processing. The flaw permits nghttp2_session_mem_send() to execute re-entrantly while nghttp2_session_mem_recv() is running, causing access to freed heap memory and potentially terminating the affected process. The identified affected release lines are Node.js 26.x, 24.x, and 22.x, with versions 26.5.0, 24.18.0, and 22.23.1 explicitly listed as affected.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An unauthenticated network attacker can cause denial of service through a heap-use-after-free in HTTP/2 processing. The vulnerability is rated High with CVSS v3.0 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Confidentiality loss, integrity compromise, and arbitrary code execution are not established.

Mitigation

If you can’t patch tonight, do this now.

No vulnerability-specific interim workaround is documented. Apply the appropriate vendor security update.

Remediation

Patch, then assume compromise.

Install the applicable vendor security update for Node.js and related runtime packages. Debian 12 Bookworm fixes the issue in version 18.20.4+dfsg-1~deb12u3, and Debian 13 Trixie fixes it in version 20.19.2+dfsg-1+deb13u3. Updates are also available for affected Photon OS, TencentOS, and RHEL packages. For bundled deployments, fixed releases include NodeJS Buildpack 1.9.20, Ruby Buildpack 1.10.85 for offline cflinuxfs4, and .NET Core Buildpack 2.4.106 for offline cflinuxfs4. Exact upstream fixed versions for the 26.x, 24.x, and 22.x release lines are not specified.

Public exploits

Exploits

1 exploit validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit.

View more in app →

CVE-2026-56848Repository is a standalone JavaScript proof-of-concept for CVE-2026-56848, a Node.js HTTP/2 heap-use-after-free caused by re-entrant nghttp2 send during receive. The repo contains: (1) exploit.js, the main exploit client; (2) server.js, a minimal vulnerable HTTP/2 target for local reproduction; (3) Dockerfile, which builds Node.js v22.23.1 with AddressSanitizer and runs server.js on port 8000; plus README documentation and ignore files. The exploit capability is remote, unauthenticated denial of service against vulnerable Node.js HTTP/2 servers. exploit.js uses raw TCP sockets rather than Node's high-level HTTP/2 client so it can precisely control frame ordering and packetization. It sends the HTTP/2 client preface and SETTINGS, waits for the server SETTINGS, acknowledges them, opens stream 1, then sends in one corked write a GOAWAY frame followed by HEADERS for new odd-numbered streams (3, 5, 7, ...). This is designed so the server processes GOAWAY and subsequent refused streams inside a single nghttp2_session_mem_recv() call, causing SubmitRstStream(REFUSED_STREAM) to call SendPendingData() re-entrantly and trigger the use-after-free. The script supports configurable host, port, iteration count, number of refused streams, and settle timeout, and logs any RST_STREAM frames returned. server.js is not malicious payload code; it is a minimal local target that starts an h2c server and intentionally does almost nothing at the application layer because the bug is triggered during frame processing before normal request handling. The Dockerfile operationalizes testing by compiling a vulnerable ASan-instrumented Node.js binary from source and exposing port 8000, making crashes deterministic and easy to observe. Overall, this is a real exploit PoC rather than a detector. It does not provide code execution or persistence; its practical effect is crashing vulnerable Node.js HTTP/2 services through crafted network traffic.open-flaw · Disclosed Aug 19, 2026 · javascript · dockerfile · networkOperational

External references

References

MITRE CVEcve.org · CVE-2026-56848 NVDnvd.nist.gov/vuln/detail/CVE-2026-56848 MITRE CWE · CWE-416Use After Free nodejs.orgnodejs.org/en/blog/vulnerability/july-2026-security-releases

Activity feed

Recent activity

59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

fedora bodhi security updatesNews · Nov 2, 2026FEDORA-2026-5c08945adb - security update for nodejs24 - Fedora Updates SystemA heap-use-after-free flaw in Node.js HTTP/2 handling can cause denial of service.Read more ↗fedora bodhi security updatesNews · Nov 2, 2026FEDORA-2026-d6c2df6970 - security update for nodejs24 - Fedora Updates SystemA heap-use-after-free in Node.js HTTP/2 handling can cause denial of service. The content does not establish code execution. Included in the pending Fedora nodejs24 security update.Read more ↗tenable nessus pluginsNews · Nov 2, 2026Photon OS 5.0: Nodejs PHSA-2026-5.0-90-1029 | Tenable®A vulnerability addressed by the Photon OS 5.0 Node.js package update. The content does not describe its individual mechanism or impact.Read more ↗bugflationNews · Oct 22, 2026Microsoft FORGE index credits 1 Node.js CVEs - BugflationA use-after-free vulnerability in Node.js, listed as High severity with a score of 7.5 and a CNA publication date of August 4, 2026. The content identifies it in Microsoft's public FORGE vulnerability research index but provides no exploitation details.Read more ↗

+39 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity9Community discussion across Reddit, Mastodon, and other social sources.

HighPublic exploitVulnerability

CVE-2026-56848

Heap-use-after-free in Node.js HTTP/2 handling

Published Aug 4, 2026 · Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

11 mentions · peak 3 in a dayToday

CVSS7.5High · v3

EPSS0.52%44th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

IdentifiersCVE-2026-56848CWE-416 · Use After Free

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Mitigation

If you can’t patch tonight, do this now.

No vulnerability-specific interim workaround is documented. Apply the appropriate vendor security update.

Remediation

Patch, then assume compromise.

Public exploits

Exploits

1 exploit validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit.

View more in app →

External references

References

MITRE CVEcve.org · CVE-2026-56848 NVDnvd.nist.gov/vuln/detail/CVE-2026-56848 MITRE CWE · CWE-416Use After Free nodejs.orgnodejs.org/en/blog/vulnerability/july-2026-security-releases

Activity feed

Recent activity

59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

+39 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity9Community discussion across Reddit, Mastodon, and other social sources.