CVE-2026-56848

A heap-use-after-free vulnerability in Node.js HTTP/2 handling can be exploited due to re-entrant calls to `nghttp2_session_mem_send()` while `nghttp2_session_mem_recv()` is in progress. This flaw poses a significant risk of memory corruption, potentially leading to application crashes or arbitrary code execution. Organizations using Node.js versions 26.x, 24.x, and 22.x should prioritize patching this vulnerability to mitigate potential exploits.