A flaw in Node.js HTTP/2 handling permits the function nghttp2_session_mem_send() to be invoked again while nghttp2_session_mem_recv() is still executing, causing a heap‑use‑after‑free condition. The memory corruption that results can lead to a denial‑of‑service attack. This vulnerability falls under CWEs 416 and 825, indicating a misuse or flaw in memory management and incorrect default behavior for unauthenticated users.

Node.js versions 26.x, 24.x, and 22.x are affected. The vulnerability originates in the nodejs:node product and impacts servers or applications that use these Node.js releases and rely on the HTTP/2 protocol.

The CVSS score of 7.5 classifies the vulnerability as high severity; however, the EPSS score is < 1% and it is not listed in CISA KEV. The likely attack vector is remote, requiring an attacker to send specially crafted HTTP/2 traffic to a Node.js application. Exploitation requires the ability to send multiple concurrent or overlapping HTTP/2 requests that trigger the re‑entrant call. Given the severity and remote nature, timely remediation is recommended.