CVE-2026-56848

CVE-2026-56848 is a heap-use-after-free in Node.js HTTP/2 session handling, affecting versions 22.x, 24.x, and 26.x. The root cause is a structural mismatch between Node.js's single-threaded event loop and nghttp2's concurrency model: HTTP/2 permits stream callbacks to manipulate session-level state that affects other streams, but Node.js's binding surfaces these as independent callback invocations without synchronizing access to shared session state. When one stream's callback triggers activity on the session that impacts another stream, re-entrancy into nghttp2's session functions becomes possible — and that's when the use-after-free occurs. The practical question you need to answer: can application developers trigger this through normal HTTP/2 usage, or is it limited to internal binding re-entrancy? If the re-entrancy vector is reachable through the public API — sending certain stream combinations that trigger cross-stream state changes in handlers — then this is exploitable via valid traffic, not just a library-internal bug. Check whether your HTTP/2 handlers manipulate streams other than the one receiving the callback, or whether libraries you depend on do so. If they do, that traffic pattern may be exploitable. The fix will almost certainly be a narrow guard condition preventing re-entrant nghttp2 calls rather than a re-architecting of the binding model — three major versions shipped with this pattern, suggesting the underlying design wasn't revisited. Monitor for similar symptoms in other protocol bindings (crypto, TLS) where Node.js wraps libraries designed for caller-coordinated concurrency. The event-loop abstraction provides no protection against stateful re-entrancy at the library boundary, and this class of vulnerability has appeared before in Node.js's HTTP/2 and crypto implementations.

Reviewed through automated stages and approved by a human before publication.