Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123866
HTTP/2 stream teardown use-after-free leaks memory in Node.js
- CVSS 3.0
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free in Node.js HTTP/2 stream teardown can write freed or unrelated heap memory, including other connections' response buffers, to a peer. On 26.x and 24.x (after the window-size change in 26.9.0 and 24.22.0) a remote peer can drive teardown with no authentication or user interaction. On 22.x, 24.x, and 26.x the same defect is reachable when the application tears down a stream, such as a per-stream idle timeout. Impact is disclosure of response memory.
What to do: Apply the Node.js November 11 security release that addresses CVE-2026-123866. Fixed versions are not stated here.
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Weakness
- CWE-416
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N