🎯 New Report #3833629: Re-entrant `nghttp2 session mem send()` during `nghttp2 session mem recv()` causes heap-use-after-free in Node.js HTTP/2
🔺Severity: High
👽 Reporter: hahahkim
⭐️ Reputation: 130
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-30
⏰ Disclosed: 2026-08-28 14:15:35
📝 Summary: A flaw was discovered in the Node.js HTTP/2 implementation that allowed the nghttp2 session mem send() function to be called re-entrantly while nghttp2 session mem recv() was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x.
📂 Report JSON File: 3833629
@hackeronereports