Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123862
Uncatchable zlib crash in Node.js on peer disconnect
- CVSS 3.0
- 2.9 low
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An uncatchable exception in the Node.js zlib streaming API is thrown when a peer disconnects while data is being compressed and the app has called deflate.params(). The params callback asserts a native handle that pipeline() has already destroyed, so ERR_INTERNAL_ASSERTION bypasses stream error handling and terminates the process. Only apps that call deflate.params() while streaming to a peer are affected; that pattern is uncommon. Node.js 26.x, 24.x, and 22.x are affected.
What to do: Install the Node.js November 11 security release covering CVE-2026-123862. Fixed version numbers were not stated.
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Weakness
- CWE-248
- Vector
- CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L