CVE-2026-56848: 
npm vulnerability analysis and mitigation

CVE-2026-56848 is a heap-use-after-free vulnerability in Node.js HTTP/2 session handling, officially titled "HTTP/2 re-entrant send can cause heap-use-after-free." The flaw allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is still executing, corrupting heap memory and enabling denial of service. It affects Node.js 26.x (≤26.5.0), 24.x (≤24.18.0), and 22.x (≤22.23.1). The vulnerability was reported by researcher "hahahkim," disclosed on July 29, 2026 via the Node.js security advisory, and published to NVD on August 4, 2026. It carries a CVSS v3.0 base score of 7.5 (High) (Node.js Advisory, GitHub Advisory, Red Hat Bugzilla).

The root cause is a re-entrancy flaw (CWE-416: Use After Free; CWE-825: Expired Pointer Dereference) in Node.js's HTTP/2 session management via the embedded nghttp2 library. During the execution of nghttp2_session_mem_recv() — which processes incoming HTTP/2 frames — a code path can trigger nghttp2_session_mem_send() to be invoked re-entrantly, causing the session object or associated buffers to be freed and then accessed again. An unauthenticated remote attacker can trigger this condition by sending crafted HTTP/2 traffic to a vulnerable Node.js server, requiring no privileges or user interaction. The attack is network-accessible, low-complexity, and automatable (Node.js Advisory, GitHub Advisory).

Successful exploitation causes a heap-use-after-free condition that crashes the Node.js process, resulting in a complete denial of service for any application relying on HTTP/2. The impact is limited to availability — there is no confidentiality or integrity impact, and no evidence of code execution being achievable through this specific flaw. All active Node.js release lines (22.x, 24.x, 26.x) are affected, meaning a wide range of production Node.js HTTP/2 servers are at risk of being remotely crashed by unauthenticated attackers (Node.js Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.55–0.62%, placing it in roughly the 47th percentile for exploitation likelihood within 30 days. However, the attack is automatable and requires no authentication, which increases the practical risk for internet-exposed Node.js HTTP/2 servers (GitHub Advisory, Node.js Advisory).

1. Reconnaissance: Identify internet-facing Node.js servers running HTTP/2 (versions ≤26.5.0, ≤24.18.0, or ≤22.23.1) using tools like Shodan or Censys, filtering for HTTP/2-enabled services (ALPN h2).
2. Establish HTTP/2 connection: Initiate a valid HTTP/2 connection to the target server to set up an nghttp2 session.
3. Craft re-entrant trigger: Send a sequence of crafted HTTP/2 frames designed to trigger a send operation (nghttp2_session_mem_send()) from within the receive callback (nghttp2_session_mem_recv()), exploiting the re-entrancy flaw in session state management.
4. Trigger heap-use-after-free: The re-entrant call frees and then accesses session memory, causing a heap corruption that crashes the Node.js process.
5. Achieve denial of service: The Node.js application process terminates, taking down any services hosted on it until manually restarted (Node.js Advisory, GitHub Advisory).

• Network: Unusual or malformed HTTP/2 frame sequences from a single source IP targeting a Node.js server; repeated connection attempts over port 443 or 80 using ALPN h2 from the same client.
• Logs: Sudden Node.js process crash logs or unhandled exception traces referencing nghttp2 or HTTP/2 session handling; application restart events in process managers (e.g., PM2, systemd) coinciding with HTTP/2 traffic spikes.
• Process: Unexpected termination of the Node.js process (exit code indicating signal/crash, e.g., SIGSEGV or SIGABRT) without a corresponding application-level error; core dump files generated in the working directory of the Node.js process.
• System: Repeated process restarts logged by systemd or a container orchestrator (e.g., Kubernetes pod crash loops) correlated with inbound HTTP/2 connections (Node.js Advisory).

Node.js has released patched versions addressing this vulnerability: v22.23.2, v24.18.1, and v26.5.1. All users on affected release lines should upgrade immediately. As an interim workaround, if HTTP/2 is not required by the application, disabling HTTP/2 support and restricting the server to HTTP/1.1 reduces the attack surface. End-of-life Node.js versions (e.g., 18.x, 20.x) are also affected and should be migrated to a supported, patched release (Node.js Advisory, GitHub Advisory).

The Node.js project released a coordinated security advisory on July 29, 2026 covering 11 CVEs across all active release lines, with CVE-2026-56848 among the highest-severity issues. Security news outlets including CyberSecurityNews, Cryptika, and SecurityOnline covered the release, noting the breadth of the patch addressing server-crashing and filesystem restriction bypass flaws. Red Hat tracked the issue via Bugzilla and SUSE issued security updates for their Node.js packages. HeroDevs published a detailed blog post covering the July 2026 security release for users on end-of-life Node.js versions (Node.js Advisory, Red Hat Bugzilla).