{"id":"CVE-2026-56848","published":"2026-08-04T17:16:56.207","lastModified":"2026-08-04T18:16:53.500","description":"A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw in Node.js HTTP/2 handling can lead to a heap-use-after-free condition when `nghttp2_session_mem_send()` is called re-entrantly while `nghttp2_session_mem_recv()` is executing, which could allow attackers to crash the application or execute arbitrary code.","exploitability":"Exploiting this vulnerability requires specific conditions and knowledge of the affected Node.js versions. It is moderately difficult due to the need for precise timing and control over HTTP/2 requests.","blast_radius":"If exploited, this could result in a denial of service or potentially lead to arbitrary code execution on vulnerable systems running affected Node.js versions.","remediation":"Upgrade to a non-vulnerable version of Node.js as soon as possible.","tags":["heap-use-after-free","http2","nodejs"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:54:16.718Z"}}