Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-56848

Fixed in a distro release EPSS <1%CVSS 7.5

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Published 2026-08-04 · CVE record · OSV

Products: NodeJS Node

Distro releases

ReleasePackageFixed in
AlmaLinux:10nodejs1:22.23.2-1.el10_2
AlmaLinux:10nodejs-devel1:22.23.2-1.el10_2
AlmaLinux:10nodejs-docs1:22.23.2-1.el10_2
AlmaLinux:10nodejs-full-i18n1:22.23.2-1.el10_2
AlmaLinux:10nodejs-libs1:22.23.2-1.el10_2
AlmaLinux:10nodejs-npm1:10.9.8-1.22.23.2.1.el10_2
AlmaLinux:10nodejs241:24.19.0-1.el10_2
AlmaLinux:10nodejs24-devel1:24.19.0-1.el10_2
AlmaLinux:10nodejs24-docs1:24.19.0-1.el10_2
AlmaLinux:10nodejs24-full-i18n1:24.19.0-1.el10_2
AlmaLinux:10nodejs24-libs1:24.19.0-1.el10_2
AlmaLinux:10nodejs24-npm1:11.17.0-1.24.19.0.1.el10_2
AlmaLinux:8nodejs1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
AlmaLinux:8nodejs1:22.23.2-1.module_el8.10.0+4265+75d28086
AlmaLinux:8nodejs-devel1:22.23.2-1.module_el8.10.0+4265+75d28086
AlmaLinux:8nodejs-devel1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
AlmaLinux:8nodejs-docs1:22.23.2-1.module_el8.10.0+4265+75d28086
AlmaLinux:8nodejs-docs1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
AlmaLinux:8nodejs-full-i18n1:22.23.2-1.module_el8.10.0+4265+75d28086
AlmaLinux:8nodejs-full-i18n1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
AlmaLinux:8nodejs-libs1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
AlmaLinux:8nodejs-libs1:22.23.2-1.module_el8.10.0+4265+75d28086
AlmaLinux:8nodejs-nodemon3.1.14-2.module_el8.10.0+4250+09238ed4
AlmaLinux:8nodejs-nodemon3.1.14-2.module_el8.10.0+4252+aedd4c30
AlmaLinux:8nodejs-packaging2021.06-6.module_el8.10.0+4158+e796f37f
AlmaLinux:8nodejs-packaging2021.06-6.module_el8.10.0+4086+70facd4a
AlmaLinux:8nodejs-packaging-bundler2021.06-6.module_el8.10.0+4086+70facd4a
AlmaLinux:8nodejs-packaging-bundler2021.06-6.module_el8.10.0+4158+e796f37f
AlmaLinux:8npm1:11.17.0-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a
AlmaLinux:8npm1:10.9.8-1.22.23.2.1.module_el8.10.0+4265+75d28086
AlmaLinux:8v8-12.4-devel3:12.4.254.21-1.22.23.2.1.module_el8.10.0+4265+75d28086
AlmaLinux:8v8-13.6-devel3:13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a
AlmaLinux:9nodejs1:24.19.0-1.module_el9.8.0+301+084fac05
AlmaLinux:9nodejs1:22.23.2-1.module_el9.8.0+302+959ebcd4
AlmaLinux:9nodejs-devel1:24.19.0-1.module_el9.8.0+301+084fac05
AlmaLinux:9nodejs-devel1:22.23.2-1.module_el9.8.0+302+959ebcd4
AlmaLinux:9nodejs-docs1:24.19.0-1.module_el9.8.0+301+084fac05
AlmaLinux:9nodejs-docs1:22.23.2-1.module_el9.8.0+302+959ebcd4
AlmaLinux:9nodejs-full-i18n1:22.23.2-1.module_el9.8.0+302+959ebcd4
AlmaLinux:9nodejs-full-i18n1:24.19.0-1.module_el9.8.0+301+084fac05
AlmaLinux:9nodejs-libs1:22.23.2-1.module_el9.8.0+302+959ebcd4
AlmaLinux:9nodejs-libs1:24.19.0-1.module_el9.8.0+301+084fac05
AlmaLinux:9nodejs-nodemon3.1.14-3.module_el9.8.0+292+f4eaf8b2
AlmaLinux:9nodejs-nodemon3.1.14-2.module_el9.8.0+291+0bb98cce
AlmaLinux:9nodejs-packaging2021.06-6.module_el9.7.0+209+ecf6523e
AlmaLinux:9nodejs-packaging2021.06-6.module_el9.7.0+227+12323393
AlmaLinux:9nodejs-packaging-bundler2021.06-6.module_el9.7.0+209+ecf6523e
AlmaLinux:9nodejs-packaging-bundler2021.06-6.module_el9.7.0+227+12323393
AlmaLinux:9npm1:11.17.0-1.24.19.0.1.module_el9.8.0+301+084fac05
AlmaLinux:9npm1:10.9.8-1.22.23.2.1.module_el9.8.0+302+959ebcd4
AlmaLinux:9v8-12.4-devel3:12.4.254.21-1.22.23.2.1.module_el9.8.0+302+959ebcd4
AlmaLinux:9v8-13.6-devel3:13.6.233.17-1.24.19.0.1.module_el9.8.0+301+084fac05
Alpine:v3.21nodejs22.23.2-r0
Alpine:v3.22nodejs22.23.2-r0
Alpine:v3.23nodejs24.18.1-r0
Alpine:v3.24nodejs24.18.1-r0
Chainguardnodejs-20no fix
Chainguardnodejs-25no fix
Debian:12nodejs18.20.4+dfsg-1~deb12u3
Debian:13nodejs20.19.2+dfsg-1+deb13u3
Debian:14nodejs24.19.0+dfsg+~cs24.13.3-1
Red Hat:enterprise_linux:10.2nodejs1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs-debuginfo1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs-devel1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs-docs1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs-full-i18n1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs-libs1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs-libs-debuginfo1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs-npm1:10.9.8-1.22.23.2.1.el10_2
Red Hat:enterprise_linux:10.2nodejs221:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs22-debuginfo1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs22-debugsource1:22.23.2-1.el10_2
Red Hat:enterprise_linux:10.2nodejs241:24.19.0-1.el10_2
Red Hat:enterprise_linux:10.2nodejs24-debuginfo1:24.19.0-1.el10_2
Red Hat:enterprise_linux:10.2nodejs24-debugsource1:24.19.0-1.el10_2
Red Hat:enterprise_linux:10.2nodejs24-devel1:24.19.0-1.el10_2
Red Hat:enterprise_linux:10.2nodejs24-docs1:24.19.0-1.el10_2
Red Hat:enterprise_linux:10.2nodejs24-full-i18n1:24.19.0-1.el10_2
Red Hat:enterprise_linux:10.2nodejs24-libs1:24.19.0-1.el10_2
Red Hat:enterprise_linux:10.2nodejs24-libs-debuginfo1:24.19.0-1.el10_2
Red Hat:enterprise_linux:10.2nodejs24-npm1:11.17.0-1.24.19.0.1.el10_2
Red Hat:enterprise_linux:8nodejs1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs1:24.19.0-1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-debuginfo1:24.19.0-1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-debuginfo1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-debugsource1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-debugsource1:24.19.0-1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-devel1:24.19.0-1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-devel1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-docs1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-docs1:24.19.0-1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-full-i18n1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-full-i18n1:24.19.0-1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-libs1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-libs1:24.19.0-1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-libs-debuginfo1:22.23.2-1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-libs-debuginfo1:24.19.0-1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-nodemon0:3.1.14-2.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-nodemon0:3.1.14-2.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8nodejs-packaging-bundler0:2021.06-6.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8nodejs-packaging-bundler0:2021.06-6.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8npm1:11.17.0-1.24.19.0.1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:8npm1:10.9.8-1.22.23.2.1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8v8-12.4-devel3:12.4.254.21-1.22.23.2.1.module+el8.10.0+24710+c2e9b41f
Red Hat:enterprise_linux:8v8-13.6-devel3:13.6.233.17-1.24.19.0.1.module+el8.10.0+24711+b610b202
Red Hat:enterprise_linux:9nodejs1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-debuginfo1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-debuginfo1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-debugsource1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-debugsource1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-devel1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-devel1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-docs1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-docs1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-full-i18n1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-full-i18n1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-libs1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-libs1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-libs-debuginfo1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-libs-debuginfo1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-nodemon0:3.1.14-2.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-nodemon0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-packaging0:2021.06-6.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-packaging0:2021.06-6.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9nodejs-packaging-bundler0:2021.06-6.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9nodejs-packaging-bundler0:2021.06-6.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9npm1:11.17.0-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux:9npm1:10.9.8-1.22.23.2.1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9v8-12.4-devel3:12.4.254.21-1.22.23.2.1.module+el9.8.0+24709+804d6b5b
Red Hat:enterprise_linux:9v8-13.6-devel3:13.6.233.17-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d
Red Hat:enterprise_linux_eus:10.0nodejs1:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs-debuginfo1:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs-devel1:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs-docs1:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs-full-i18n1:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs-libs1:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs-libs-debuginfo1:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs-npm1:10.9.8-1.22.23.2.1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs221:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs22-debuginfo1:22.23.2-1.el10_0
Red Hat:enterprise_linux_eus:10.0nodejs22-debugsource1:22.23.2-1.el10_0
Red Hat:rhel_eus:9.6nodejs1:22.23.2-1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6nodejs-debuginfo1:22.23.2-1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6nodejs-debugsource1:22.23.2-1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6nodejs-devel1:22.23.2-1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6nodejs-docs1:22.23.2-1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6nodejs-full-i18n1:22.23.2-1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6nodejs-libs1:22.23.2-1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6nodejs-libs-debuginfo1:22.23.2-1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6nodejs-nodemon0:3.1.14-2.module+el9.6.0+24789+4011c12f
Red Hat:rhel_eus:9.6nodejs-packaging0:2021.06-4.module+el9.6.0+23473+45664c2d
Red Hat:rhel_eus:9.6nodejs-packaging-bundler0:2021.06-4.module+el9.6.0+23473+45664c2d
Red Hat:rhel_eus:9.6npm1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
Red Hat:rhel_eus:9.6v8-12.4-devel3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
Rocky Linux:10nodejs221:22.23.2-1.el10_2
Rocky Linux:10nodejs241:24.19.0-1.el10_2
Rocky Linux:8nodejs1:22.23.2-1.module+el8.10.0+40306+15f89705
Rocky Linux:8nodejs-nodemon0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
Rocky Linux:8nodejs-nodemon0:3.1.14-2.module+el8.10.0+40278+50b003a3
Rocky Linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+40171+8fa9c325
Rocky Linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+40048+6d99f608
Rocky Linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+40172+38f6fdd1
Rocky Linux:9nodejs-nodemon0:3.1.14-2.module+el9.8.0+40264+d9b257bb
Rocky Linux:9nodejs-nodemon0:3.1.14-2.module+el9.8.0+40280+057606e8
Rocky Linux:9nodejs-nodemon0:3.1.14-3.module+el9.8.0+40281+14cc6568
Rocky Linux:9nodejs-packaging0:2021.06-6.module+el9.7.0+40052+e32ea525
Rocky Linux:9nodejs-packaging0:2021.06-6.module+el9.7.0+40153+4d595597
Rocky Linux:9nodejs-packaging0:2021.06-6.module+el9.8.0+40164+8921ab53
Rocky Linux:9nodejs-packaging0:2021.06-6.module+el9.7.0+40165+d075e3f2
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSnodejs1616.20.2-150400.3.42.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSnodejs1818.20.8-150400.9.39.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSnodejs1616.20.2-150400.3.42.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSnodejs1818.20.8-150400.9.39.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSnodejs1818.20.8-150400.9.39.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSnodejs2020.20.2-150500.11.30.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSnodejs1818.20.8-150400.9.39.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSnodejs2020.20.2-150500.11.30.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7nodejs2222.23.2-150700.3.18.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7nodejs2424.18.1-150700.15.16.1
SUSE:Linux Enterprise Server 12 SP5-LTSSnodejs1818.20.8-8.44.1
SUSE:Linux Enterprise Server 15 SP4-LTSSnodejs1616.20.2-150400.3.42.1
SUSE:Linux Enterprise Server 15 SP4-LTSSnodejs1818.20.8-150400.9.39.1
SUSE:Linux Enterprise Server 15 SP5-LTSSnodejs1818.20.8-150400.9.39.1
SUSE:Linux Enterprise Server 15 SP5-LTSSnodejs2020.20.2-150500.11.30.1
SUSE:Linux Enterprise Server 15 SP6-LTSSnodejs2020.20.2-150600.3.21.1
SUSE:Linux Enterprise Server 15 SP6-LTSSnodejs2222.23.2-150600.13.24.1
SUSE:Linux Enterprise Server 16.0nodejs2222.23.2-160000.1.1
SUSE:Linux Enterprise Server 16.0nodejs2424.18.1-160000.1.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5nodejs1818.20.8-8.44.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4nodejs1616.20.2-150400.3.42.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4nodejs1818.20.8-150400.9.39.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5nodejs1818.20.8-150400.9.39.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5nodejs2020.20.2-150500.11.30.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6nodejs2020.20.2-150600.3.21.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6nodejs2222.23.2-150600.13.24.1
SUSE:Linux Enterprise Server for SAP applications 16.0nodejs2222.23.2-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0nodejs2424.18.1-160000.1.1
Ubuntu:24.04:LTSnodejsno fix
Ubuntu:26.04:LTSnodejsno fix
Ubuntu:26.10nodejsno fix
Ubuntu:Pro:14.04:LTSnodejsno fix
Ubuntu:Pro:16.04:LTSnodejsno fix
Ubuntu:Pro:18.04:LTSnodejsno fix
Ubuntu:Pro:20.04:LTSnodejsno fix
Ubuntu:Pro:22.04:LTSnodejsno fix
Wolfinodejs-20no fix
Wolfinodejs-25no fix
openSUSE:Leap 16.0nodejs2222.23.2-160000.1.1
openSUSE:Leap 16.0nodejs2424.18.1-160000.1.1
openSUSE:Tumbleweednodejs2424.18.1-1.1
openSUSE:Tumbleweednodejs2626.5.1-1.1