Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123874
Use-after-free in Node.js HTTP/2 file serving
- CVSS 3.0
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free in Node.js HTTP/2 lets an unauthenticated remote client corrupt server memory over TLS or cleartext. The client frees an Http2Stream while a write that still references it remains queued; completion then calls through the freed object. This occurs only when the app serves files with respondWithFile() or respondWithFD() under otherwise default settings. Node.js 26.x since 26.9.0 and 24.x since 24.22.0 are affected.
What to do: Apply the Node.js November 11 security release for CVE-2026-123874. Fixed version numbers were not stated.
| Product | Affected |
|---|---|
| Node.js | 26.x since 26.9.0 |
| Node.js | 24.x since 24.22.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
- Weakness
- CWE-416
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H