CVE-2026-123866 is a use-after-free vulnerability in Node.js HTTP/2 stream teardown that can leak response memory, including data from other connections' response buffers, to a peer. This occurs when a stream is torn down while a write is still backpressured, causing freed or unrelated heap memory to be sent instead of the intended response. The flaw affects Node.js versions 22.x, 24.x, and 26.x. The vulnerability has a high severity score of 7.5 and impacts confidentiality but not integrity or availability.