dgit.raspbian.org Git - nodejs.git/commit

author	Matteo Collina <hello@matteocollina.com>
	Wed, 1 Jul 2026 07:43:01 +0000 (09:43 +0200)
committer	Bastien Roucariès <rouca@debian.org>
	Sun, 16 Aug 2026 17:34:06 +0000 (19:34 +0200)
commit	4fcec73db4a0d753f435fe9fdacc8372b1be54a5
tree	80c28c16a6d832e27c624b094f039c9a7aab4c02	tree \| snapshot
parent	df8c0ff2ca7b6bf457e2a4d17606b6b35b1bc912	commit \| diff

http2: defer rst stream while in scope

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/921
Refs: https://hackerone.com/reports/3833629
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-56848
origin: https://github.com/nodejs/node/commit/daa6d25e3dceb30edb832a778ec0610c8bc2dd12
bug: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-re-entrant-send-can-cause-heap-use-after-free-cve-2026-56848---high

Gbp-Pq: Topic sec
Gbp-Pq: Name CVE-2026-56848.patch

src/node_http2.cc		diff \| blob \| history
test/parallel/test-http2-rst-stream-reentrancy.js	[new file with mode: 0644]	blob