Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-679w-638g-xf9h

Опубликовано: 04 авг. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 7.5

Описание

A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

EPSS

Процентиль: 43%
0.00548
Низкий

7.5 High

CVSS3

Дефекты

CWE-416

Связанные уязвимости

CVSS3: 7.5
ubuntu
3 дня назад

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

CVSS3: 7.5
nvd
3 дня назад

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

CVSS3: 7.5
debian
3 дня назад

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` ...

EPSS

Процентиль: 43%
0.00548
Низкий

7.5 High

CVSS3

Дефекты

CWE-416