Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123875
NULL pointer DoS in Node.js HTTP/2 file serving
- CVSS 3.0
- 5.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A NULL pointer dereference in Node.js HTTP/2 crashes the process when an unauthenticated client cancels a file download served with stream.respondWithFile() or stream.respondWithFD(), over TLS or cleartext. No crafted frames are required; a few cancelled requests against a default file-serving handler are enough. The attacker gains only availability impact. Node.js 26.x, 24.x, and 22.x are affected.
What to do: Apply the Node.js project's November 11 security releases for CVE-2026-123875. No workaround is stated.
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Weakness
- CWE-476
- Vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H