Threats tagged 'ghsa-v6qh-ch8g-j833'

A NULL pointer dereference vulnerability in Node.js HTTP/2 allows an unauthenticated client to crash the server by cancelling file downloads. This affects Node.js versions 22.x, 24.x, and 26.x. The issue occurs when the server uses stream.respondWithFile() or stream.respondWithFD() to serve files, and the client cancels the request, causing a StreamPipe to be torn down improperly and leading to a NULL pointer dereference that aborts the process. No special crafted frames are required to trigger the crash.