Use-after-free error in http2 server #64113

Closed
#64166
Closed
Use-after-free error in http2 server#64113
#64166

Description

@Eusgor
Eusgor
opened on Jun 24, 2026

Version

22.23.1

Platform

Linux host-73 6.12.74-6.12-alt1 #1 SMP PREEMPT_DYNAMIC Fri Mar 6 13:49:54 UTC 2026 x86_64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

  1. Build node.js with asan. Use clang19.1 (Also reproducible with clang17 and clang21.1).
$ cd node
$ export CC=clang-19 CXX=clang++-19
$ export CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address"
$ ./configure --prefix=$(pwd)/buildroot --enable-asan
$ make install
  1. Running JS script test.js
./buildroot/bin/node test.js
  1. Run command in another terminal.
netcat localhost 8000 < crash.txt

File crash.txt

How often does it reproduce? Is there a required condition?

Always

What is the expected behavior? Why is that the expected behavior?

There should be no use-after-free error.

What do you see instead?

=================================================================
==988776==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d0000027c4 at pc 0x5623311b4bc7 bp 0x7ffd4e856af0 sp 0x7ffd4e856ae8
READ of size 1 at 0x50d0000027c4 thread T0
#0 0x5623311b4bc6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#1 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#5 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#6 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#7 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#8 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#9 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#10 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#11 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#12 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#13 0x7fd87303fd44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#14 0x56232dd8f530 in _start (/home/user/node-upstream/buildroot/bin/node+0x178f530) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
0x50d0000027c4 is located 132 bytes inside of 144-byte region [0x50d000002740,0x50d0000027d0)
freed by thread T0 here:
#0 0x56232de2e536 in free /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x56232e254245 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::FreeImpl(void*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c54245) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119e3ad in nghttp2_session_close_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9e3ad) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311aac9d in session_close_stream_on_goaway nghttp2_session.c
#4 0x5623311a3281 in session_after_frame_sent1 nghttp2_session.c
#5 0x56233119ed9a in nghttp2_session_mem_send (/home/user/node-upstream/buildroot/bin/node+0x4b9ed9a) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e21d978 in node::http2::Http2Session::SendPendingData() (/home/user/node-upstream/buildroot/bin/node+0x1c1d978) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e220b35 in node::http2::Http2Stream::SubmitRstStream(unsigned int) (/home/user/node-upstream/buildroot/bin/node+0x1c20b35) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e2354b2 in node::http2::Http2Stream::RstStream(v8::FunctionCallbackInfo<v8::Value> const&) (/home/user/node-upstream/buildroot/bin/node+0x1c354b2) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#9 0x5622d048f5e1 in Builtins_CallApiCallbackGeneric embedded.o
#10 0x5622d048d8dd in Builtins_InterpreterEntryTrampoline embedded.o
#11 0x5622d048b4db in Builtins_JSEntryTrampoline embedded.o
#12 0x5622d048b202 in Builtins_JSEntry embedded.o
#13 0x56232eb6aec5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) execution.cc
#14 0x56232eb69468 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) (/home/user/node-upstream/buildroot/bin/node+0x2569468) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e8206cd in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x22206cd) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x56232de946bc in node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) (/home/user/node-upstream/buildroot/bin/node+0x18946bc) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#17 0x56232dec6052 in node::AsyncWrap::MakeCallback(v8::Local<v8::Function>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x18c6052) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#18 0x56232e2221a5 in node::http2::Http2Session::HandleHeadersFrame(nghttp2_frame const*) (/home/user/node-upstream/buildroot/bin/node+0x1c221a5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#19 0x56232e213475 in node::http2::Http2Session::OnFrameReceive(nghttp2_session*, nghttp2_frame const*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c13475) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#20 0x5623311b25b6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb25b6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#21 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#22 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#23 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#24 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#25 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#26 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#27 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#28 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#29 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#30 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
previously allocated by thread T0 here:
#0 0x56232de2ebbc in realloc /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x56232e2543f1 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::ReallocImpl(void*, unsigned long, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c543f1) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119d997 in nghttp2_session_open_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9d997) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311a4652 in nghttp2_session_on_request_headers_received (/home/user/node-upstream/buildroot/bin/node+0x4ba4652) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x5623311b2148 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb2148) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#5 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#9 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#10 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#11 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#12 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#13 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#14 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba) in nghttp2_session_mem_recv2
Shadow bytes around the buggy address:
0x50d000002500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50d000002580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50d000002600: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
0x50d000002680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50d000002700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x50d000002780: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x50d000002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==988776==ABORTING

Additional information

The crash is reproduced in versions 25.x, 24.x, 22.x, 20.x.

I suggest patch node-fix-http2-uaf.patch

https://hackerone.com/reports/3584453

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
       blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

      Skip to content
      Use-after-free error in http2 server #64113
      Closed
      #64166
      Closed
      Use-after-free error in http2 server#64113
      #64166
      Description
      @Eusgor
      Eusgor
      opened on Jun 24, 2026
      Version
      22.23.1
      Platform
      Linux host-73 6.12.74-6.12-alt1 #1 SMP PREEMPT_DYNAMIC Fri Mar 6 13:49:54 UTC 2026 x86_64 GNU/Linux

      Subsystem
      No response
      What steps will reproduce the bug?
      1. Build node.js with asan. Use clang19.1 (Also reproducible with clang17 and clang21.1).
      $ cd node
$ export CC=clang-19 CXX=clang++-19
$ export CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address"
$ ./configure --prefix=$(pwd)/buildroot --enable-asan
$ make install

      1. Running JS script test.js
      ./buildroot/bin/node test.js

      1. Run command in another terminal.
      netcat localhost 8000 < crash.txt

      File crash.txt
      How often does it reproduce? Is there a required condition?
      Always
      What is the expected behavior? Why is that the expected behavior?
      There should be no use-after-free error.
      What do you see instead?
      =================================================================
==988776==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d0000027c4 at pc 0x5623311b4bc7 bp 0x7ffd4e856af0 sp 0x7ffd4e856ae8
READ of size 1 at 0x50d0000027c4 thread T0
#0 0x5623311b4bc6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#1 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#5 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#6 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#7 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#8 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#9 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#10 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#11 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#12 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#13 0x7fd87303fd44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#14 0x56232dd8f530 in _start (/home/user/node-upstream/buildroot/bin/node+0x178f530) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
0x50d0000027c4 is located 132 bytes inside of 144-byte region [0x50d000002740,0x50d0000027d0)
freed by thread T0 here:
#0 0x56232de2e536 in free /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x56232e254245 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::FreeImpl(void*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c54245) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119e3ad in nghttp2_session_close_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9e3ad) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311aac9d in session_close_stream_on_goaway nghttp2_session.c
#4 0x5623311a3281 in session_after_frame_sent1 nghttp2_session.c
#5 0x56233119ed9a in nghttp2_session_mem_send (/home/user/node-upstream/buildroot/bin/node+0x4b9ed9a) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e21d978 in node::http2::Http2Session::SendPendingData() (/home/user/node-upstream/buildroot/bin/node+0x1c1d978) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e220b35 in node::http2::Http2Stream::SubmitRstStream(unsigned int) (/home/user/node-upstream/buildroot/bin/node+0x1c20b35) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e2354b2 in node::http2::Http2Stream::RstStream(v8::FunctionCallbackInfo<v8::Value> const&) (/home/user/node-upstream/buildroot/bin/node+0x1c354b2) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#9 0x5622d048f5e1 in Builtins_CallApiCallbackGeneric embedded.o
#10 0x5622d048d8dd in Builtins_InterpreterEntryTrampoline embedded.o
#11 0x5622d048b4db in Builtins_JSEntryTrampoline embedded.o
#12 0x5622d048b202 in Builtins_JSEntry embedded.o
#13 0x56232eb6aec5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) execution.cc
#14 0x56232eb69468 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) (/home/user/node-upstream/buildroot/bin/node+0x2569468) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e8206cd in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x22206cd) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x56232de946bc in node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) (/home/user/node-upstream/buildroot/bin/node+0x18946bc) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#17 0x56232dec6052 in node::AsyncWrap::MakeCallback(v8::Local<v8::Function>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x18c6052) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#18 0x56232e2221a5 in node::http2::Http2Session::HandleHeadersFrame(nghttp2_frame const*) (/home/user/node-upstream/buildroot/bin/node+0x1c221a5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#19 0x56232e213475 in node::http2::Http2Session::OnFrameReceive(nghttp2_session*, nghttp2_frame const*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c13475) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#20 0x5623311b25b6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb25b6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#21 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#22 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#23 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#24 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#25 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#26 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#27 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#28 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#29 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#30 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
previously allocated by thread T0 here:
#0 0x56232de2ebbc in realloc /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x56232e2543f1 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::ReallocImpl(void*, unsigned long, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c543f1) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119d997 in nghttp2_session_open_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9d997) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311a4652 in nghttp2_session_on_request_headers_received (/home/user/node-upstream/buildroot/bin/node+0x4ba4652) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x5623311b2148 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb2148) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#5 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#9 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#10 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#11 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#12 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#13 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#14 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba) in nghttp2_session_mem_recv2
Shadow bytes around the buggy address:
0x50d000002500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50d000002580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50d000002600: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
0x50d000002680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50d000002700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x50d000002780: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x50d000002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==988776==ABORTING

      Additional information
      The crash is reproduced in versions 25.x, 24.x, 22.x, 20.x.
      I suggest patch node-fix-http2-uaf.patch
      https://hackerone.com/reports/3584453
      Metadata
      Metadata
      Assignees
      No one assigned
        Labels
        No labels
        No labels
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

          Skip to content
          Use-after-free error in http2 server #64113
          Closed
          #64166
          Closed
          Use-after-free error in http2 server#64113
          #64166
          Description
          @Eusgor
          Eusgor
          opened on Jun 24, 2026
          Version
          22.23.1
          Platform
          Linux host-73 6.12.74-6.12-alt1 #1 SMP PREEMPT_DYNAMIC Fri Mar 6 13:49:54 UTC 2026 x86_64 GNU/Linux

          Subsystem
          No response
          What steps will reproduce the bug?
          1. Build node.js with asan. Use clang19.1 (Also reproducible with clang17 and clang21.1).
          $ cd node
$ export CC=clang-19 CXX=clang++-19
$ export CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address"
$ ./configure --prefix=$(pwd)/buildroot --enable-asan
$ make install

          1. Running JS script test.js
          ./buildroot/bin/node test.js

          1. Run command in another terminal.
          netcat localhost 8000 < crash.txt

          File crash.txt
          How often does it reproduce? Is there a required condition?
          Always
          What is the expected behavior? Why is that the expected behavior?
          There should be no use-after-free error.
          What do you see instead?
          =================================================================
==988776==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d0000027c4 at pc 0x5623311b4bc7 bp 0x7ffd4e856af0 sp 0x7ffd4e856ae8
READ of size 1 at 0x50d0000027c4 thread T0
#0 0x5623311b4bc6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#1 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#5 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#6 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#7 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#8 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#9 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#10 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#11 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#12 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#13 0x7fd87303fd44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#14 0x56232dd8f530 in _start (/home/user/node-upstream/buildroot/bin/node+0x178f530) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
0x50d0000027c4 is located 132 bytes inside of 144-byte region [0x50d000002740,0x50d0000027d0)
freed by thread T0 here:
#0 0x56232de2e536 in free /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x56232e254245 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::FreeImpl(void*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c54245) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119e3ad in nghttp2_session_close_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9e3ad) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311aac9d in session_close_stream_on_goaway nghttp2_session.c
#4 0x5623311a3281 in session_after_frame_sent1 nghttp2_session.c
#5 0x56233119ed9a in nghttp2_session_mem_send (/home/user/node-upstream/buildroot/bin/node+0x4b9ed9a) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e21d978 in node::http2::Http2Session::SendPendingData() (/home/user/node-upstream/buildroot/bin/node+0x1c1d978) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e220b35 in node::http2::Http2Stream::SubmitRstStream(unsigned int) (/home/user/node-upstream/buildroot/bin/node+0x1c20b35) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e2354b2 in node::http2::Http2Stream::RstStream(v8::FunctionCallbackInfo<v8::Value> const&) (/home/user/node-upstream/buildroot/bin/node+0x1c354b2) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#9 0x5622d048f5e1 in Builtins_CallApiCallbackGeneric embedded.o
#10 0x5622d048d8dd in Builtins_InterpreterEntryTrampoline embedded.o
#11 0x5622d048b4db in Builtins_JSEntryTrampoline embedded.o
#12 0x5622d048b202 in Builtins_JSEntry embedded.o
#13 0x56232eb6aec5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) execution.cc
#14 0x56232eb69468 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) (/home/user/node-upstream/buildroot/bin/node+0x2569468) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e8206cd in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x22206cd) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x56232de946bc in node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) (/home/user/node-upstream/buildroot/bin/node+0x18946bc) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#17 0x56232dec6052 in node::AsyncWrap::MakeCallback(v8::Local<v8::Function>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x18c6052) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#18 0x56232e2221a5 in node::http2::Http2Session::HandleHeadersFrame(nghttp2_frame const*) (/home/user/node-upstream/buildroot/bin/node+0x1c221a5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#19 0x56232e213475 in node::http2::Http2Session::OnFrameReceive(nghttp2_session*, nghttp2_frame const*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c13475) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#20 0x5623311b25b6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb25b6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#21 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#22 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#23 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#24 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#25 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#26 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#27 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#28 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#29 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#30 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
previously allocated by thread T0 here:
#0 0x56232de2ebbc in realloc /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x56232e2543f1 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::ReallocImpl(void*, unsigned long, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c543f1) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119d997 in nghttp2_session_open_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9d997) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311a4652 in nghttp2_session_on_request_headers_received (/home/user/node-upstream/buildroot/bin/node+0x4ba4652) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x5623311b2148 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb2148) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#5 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#9 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#10 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#11 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#12 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#13 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#14 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba) in nghttp2_session_mem_recv2
Shadow bytes around the buggy address:
0x50d000002500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50d000002580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50d000002600: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
0x50d000002680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50d000002700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x50d000002780: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x50d000002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==988776==ABORTING

          Additional information
          The crash is reproduced in versions 25.x, 24.x, 22.x, 20.x.
          I suggest patch node-fix-http2-uaf.patch
          https://hackerone.com/reports/3584453
          Metadata
          Metadata
          Assignees
          No one assigned
            Labels
            No labels
            No labels
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              Use-after-free error in http2 server #64113
              Closed
              #64166
              Closed
              Use-after-free error in http2 server#64113
              #64166
              Description
              @Eusgor
              Eusgor
              opened on Jun 24, 2026
              Version
              22.23.1
              Platform
              Linux host-73 6.12.74-6.12-alt1 #1 SMP PREEMPT_DYNAMIC Fri Mar 6 13:49:54 UTC 2026 x86_64 GNU/Linux

              Subsystem
              No response
              What steps will reproduce the bug?
              1. Build node.js with asan. Use clang19.1 (Also reproducible with clang17 and clang21.1).
              $ cd node
$ export CC=clang-19 CXX=clang++-19
$ export CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address"
$ ./configure --prefix=$(pwd)/buildroot --enable-asan
$ make install

              1. Running JS script test.js
              ./buildroot/bin/node test.js

              1. Run command in another terminal.
              netcat localhost 8000 < crash.txt

              File crash.txt
              How often does it reproduce? Is there a required condition?
              Always
              What is the expected behavior? Why is that the expected behavior?
              There should be no use-after-free error.
              What do you see instead?
              =================================================================
==988776==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d0000027c4 at pc 0x5623311b4bc7 bp 0x7ffd4e856af0 sp 0x7ffd4e856ae8
READ of size 1 at 0x50d0000027c4 thread T0
#0 0x5623311b4bc6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#1 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#5 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#6 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#7 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#8 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#9 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#10 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#11 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#12 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#13 0x7fd87303fd44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#14 0x56232dd8f530 in _start (/home/user/node-upstream/buildroot/bin/node+0x178f530) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
0x50d0000027c4 is located 132 bytes inside of 144-byte region [0x50d000002740,0x50d0000027d0)
freed by thread T0 here:
#0 0x56232de2e536 in free /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x56232e254245 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::FreeImpl(void*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c54245) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119e3ad in nghttp2_session_close_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9e3ad) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311aac9d in session_close_stream_on_goaway nghttp2_session.c
#4 0x5623311a3281 in session_after_frame_sent1 nghttp2_session.c
#5 0x56233119ed9a in nghttp2_session_mem_send (/home/user/node-upstream/buildroot/bin/node+0x4b9ed9a) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e21d978 in node::http2::Http2Session::SendPendingData() (/home/user/node-upstream/buildroot/bin/node+0x1c1d978) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e220b35 in node::http2::Http2Stream::SubmitRstStream(unsigned int) (/home/user/node-upstream/buildroot/bin/node+0x1c20b35) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e2354b2 in node::http2::Http2Stream::RstStream(v8::FunctionCallbackInfo<v8::Value> const&) (/home/user/node-upstream/buildroot/bin/node+0x1c354b2) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#9 0x5622d048f5e1 in Builtins_CallApiCallbackGeneric embedded.o
#10 0x5622d048d8dd in Builtins_InterpreterEntryTrampoline embedded.o
#11 0x5622d048b4db in Builtins_JSEntryTrampoline embedded.o
#12 0x5622d048b202 in Builtins_JSEntry embedded.o
#13 0x56232eb6aec5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) execution.cc
#14 0x56232eb69468 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) (/home/user/node-upstream/buildroot/bin/node+0x2569468) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e8206cd in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x22206cd) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x56232de946bc in node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) (/home/user/node-upstream/buildroot/bin/node+0x18946bc) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#17 0x56232dec6052 in node::AsyncWrap::MakeCallback(v8::Local<v8::Function>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x18c6052) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#18 0x56232e2221a5 in node::http2::Http2Session::HandleHeadersFrame(nghttp2_frame const*) (/home/user/node-upstream/buildroot/bin/node+0x1c221a5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#19 0x56232e213475 in node::http2::Http2Session::OnFrameReceive(nghttp2_session*, nghttp2_frame const*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c13475) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#20 0x5623311b25b6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb25b6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#21 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#22 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#23 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#24 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#25 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#26 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#27 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#28 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#29 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#30 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
previously allocated by thread T0 here:
#0 0x56232de2ebbc in realloc /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x56232e2543f1 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::ReallocImpl(void*, unsigned long, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c543f1) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119d997 in nghttp2_session_open_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9d997) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311a4652 in nghttp2_session_on_request_headers_received (/home/user/node-upstream/buildroot/bin/node+0x4ba4652) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x5623311b2148 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb2148) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#5 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#9 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#10 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#11 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#12 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#13 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#14 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba) in nghttp2_session_mem_recv2
Shadow bytes around the buggy address:
0x50d000002500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50d000002580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50d000002600: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
0x50d000002680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50d000002700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x50d000002780: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x50d000002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==988776==ABORTING

              Additional information
              The crash is reproduced in versions 25.x, 24.x, 22.x, 20.x.
              I suggest patch node-fix-http2-uaf.patch
              https://hackerone.com/reports/3584453
              Metadata
              Metadata
              Assignees
              No one assigned
                Labels
                No labels
                No labels
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions
                  
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

                  Skip to content
                  Use-after-free error in http2 server #64113
                  Closed
                  #64166
                  Closed
                  Use-after-free error in http2 server#64113
                  #64166
                  Description
                  @Eusgor
                  Eusgor
                  opened on Jun 24, 2026
                  Version
                  22.23.1
                  Platform
                  Linux host-73 6.12.74-6.12-alt1 #1 SMP PREEMPT_DYNAMIC Fri Mar 6 13:49:54 UTC 2026 x86_64 GNU/Linux

                  Subsystem
                  No response
                  What steps will reproduce the bug?
                  1. Build node.js with asan. Use clang19.1 (Also reproducible with clang17 and clang21.1).
                  $ cd node
$ export CC=clang-19 CXX=clang++-19
$ export CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address"
$ ./configure --prefix=$(pwd)/buildroot --enable-asan
$ make install

                  1. Running JS script test.js
                  ./buildroot/bin/node test.js

                  1. Run command in another terminal.
                  netcat localhost 8000 < crash.txt

                  File crash.txt
                  How often does it reproduce? Is there a required condition?
                  Always
                  What is the expected behavior? Why is that the expected behavior?
                  There should be no use-after-free error.
                  What do you see instead?
                  =================================================================
==988776==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d0000027c4 at pc 0x5623311b4bc7 bp 0x7ffd4e856af0 sp 0x7ffd4e856ae8
READ of size 1 at 0x50d0000027c4 thread T0
#0 0x5623311b4bc6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#1 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#5 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#6 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#7 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#8 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#9 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#10 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#11 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#12 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#13 0x7fd87303fd44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#14 0x56232dd8f530 in _start (/home/user/node-upstream/buildroot/bin/node+0x178f530) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
0x50d0000027c4 is located 132 bytes inside of 144-byte region [0x50d000002740,0x50d0000027d0)
freed by thread T0 here:
#0 0x56232de2e536 in free /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x56232e254245 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::FreeImpl(void*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c54245) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119e3ad in nghttp2_session_close_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9e3ad) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311aac9d in session_close_stream_on_goaway nghttp2_session.c
#4 0x5623311a3281 in session_after_frame_sent1 nghttp2_session.c
#5 0x56233119ed9a in nghttp2_session_mem_send (/home/user/node-upstream/buildroot/bin/node+0x4b9ed9a) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e21d978 in node::http2::Http2Session::SendPendingData() (/home/user/node-upstream/buildroot/bin/node+0x1c1d978) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e220b35 in node::http2::Http2Stream::SubmitRstStream(unsigned int) (/home/user/node-upstream/buildroot/bin/node+0x1c20b35) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e2354b2 in node::http2::Http2Stream::RstStream(v8::FunctionCallbackInfo<v8::Value> const&) (/home/user/node-upstream/buildroot/bin/node+0x1c354b2) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#9 0x5622d048f5e1 in Builtins_CallApiCallbackGeneric embedded.o
#10 0x5622d048d8dd in Builtins_InterpreterEntryTrampoline embedded.o
#11 0x5622d048b4db in Builtins_JSEntryTrampoline embedded.o
#12 0x5622d048b202 in Builtins_JSEntry embedded.o
#13 0x56232eb6aec5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) execution.cc
#14 0x56232eb69468 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) (/home/user/node-upstream/buildroot/bin/node+0x2569468) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e8206cd in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x22206cd) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x56232de946bc in node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) (/home/user/node-upstream/buildroot/bin/node+0x18946bc) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#17 0x56232dec6052 in node::AsyncWrap::MakeCallback(v8::Local<v8::Function>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x18c6052) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#18 0x56232e2221a5 in node::http2::Http2Session::HandleHeadersFrame(nghttp2_frame const*) (/home/user/node-upstream/buildroot/bin/node+0x1c221a5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#19 0x56232e213475 in node::http2::Http2Session::OnFrameReceive(nghttp2_session*, nghttp2_frame const*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c13475) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#20 0x5623311b25b6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb25b6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#21 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#22 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#23 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#24 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#25 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#26 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#27 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#28 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#29 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#30 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
previously allocated by thread T0 here:
#0 0x56232de2ebbc in realloc /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x56232e2543f1 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::ReallocImpl(void*, unsigned long, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c543f1) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119d997 in nghttp2_session_open_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9d997) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311a4652 in nghttp2_session_on_request_headers_received (/home/user/node-upstream/buildroot/bin/node+0x4ba4652) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x5623311b2148 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb2148) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#5 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#9 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#10 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#11 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#12 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#13 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#14 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba) in nghttp2_session_mem_recv2
Shadow bytes around the buggy address:
0x50d000002500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50d000002580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50d000002600: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
0x50d000002680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50d000002700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x50d000002780: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x50d000002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==988776==ABORTING

                  Additional information
                  The crash is reproduced in versions 25.x, 24.x, 22.x, 20.x.
                  I suggest patch node-fix-http2-uaf.patch
                  https://hackerone.com/reports/3584453
                  Metadata
                  Metadata
                  Assignees
                  No one assigned
                    Labels
                    No labels
                    No labels
                    Type
                    No type
                    Projects
                    No projects
                      Milestone
                      No milestone
                      Relationships
                      None yet
                      Development
                      No branches or pull requests
                      Issue actions
                      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

                      Skip to content
                      Use-after-free error in http2 server #64113
                      Closed
                      #64166
                      Closed
                      Use-after-free error in http2 server#64113
                      #64166
                      Description
                      @Eusgor
                      Eusgor
                      opened on Jun 24, 2026
                      Version
                      22.23.1
                      Platform
                      Linux host-73 6.12.74-6.12-alt1 #1 SMP PREEMPT_DYNAMIC Fri Mar 6 13:49:54 UTC 2026 x86_64 GNU/Linux

                      Subsystem
                      No response
                      What steps will reproduce the bug?
                      1. Build node.js with asan. Use clang19.1 (Also reproducible with clang17 and clang21.1).
                      $ cd node
$ export CC=clang-19 CXX=clang++-19
$ export CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address"
$ ./configure --prefix=$(pwd)/buildroot --enable-asan
$ make install

                      1. Running JS script test.js
                      ./buildroot/bin/node test.js

                      1. Run command in another terminal.
                      netcat localhost 8000 < crash.txt

                      File crash.txt
                      How often does it reproduce? Is there a required condition?
                      Always
                      What is the expected behavior? Why is that the expected behavior?
                      There should be no use-after-free error.
                      What do you see instead?
                      =================================================================
==988776==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d0000027c4 at pc 0x5623311b4bc7 bp 0x7ffd4e856af0 sp 0x7ffd4e856ae8
READ of size 1 at 0x50d0000027c4 thread T0
#0 0x5623311b4bc6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#1 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#5 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#6 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#7 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#8 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#9 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#10 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#11 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#12 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#13 0x7fd87303fd44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#14 0x56232dd8f530 in _start (/home/user/node-upstream/buildroot/bin/node+0x178f530) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
0x50d0000027c4 is located 132 bytes inside of 144-byte region [0x50d000002740,0x50d0000027d0)
freed by thread T0 here:
#0 0x56232de2e536 in free /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x56232e254245 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::FreeImpl(void*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c54245) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119e3ad in nghttp2_session_close_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9e3ad) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311aac9d in session_close_stream_on_goaway nghttp2_session.c
#4 0x5623311a3281 in session_after_frame_sent1 nghttp2_session.c
#5 0x56233119ed9a in nghttp2_session_mem_send (/home/user/node-upstream/buildroot/bin/node+0x4b9ed9a) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e21d978 in node::http2::Http2Session::SendPendingData() (/home/user/node-upstream/buildroot/bin/node+0x1c1d978) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e220b35 in node::http2::Http2Stream::SubmitRstStream(unsigned int) (/home/user/node-upstream/buildroot/bin/node+0x1c20b35) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e2354b2 in node::http2::Http2Stream::RstStream(v8::FunctionCallbackInfo<v8::Value> const&) (/home/user/node-upstream/buildroot/bin/node+0x1c354b2) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#9 0x5622d048f5e1 in Builtins_CallApiCallbackGeneric embedded.o
#10 0x5622d048d8dd in Builtins_InterpreterEntryTrampoline embedded.o
#11 0x5622d048b4db in Builtins_JSEntryTrampoline embedded.o
#12 0x5622d048b202 in Builtins_JSEntry embedded.o
#13 0x56232eb6aec5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) execution.cc
#14 0x56232eb69468 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) (/home/user/node-upstream/buildroot/bin/node+0x2569468) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e8206cd in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x22206cd) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x56232de946bc in node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) (/home/user/node-upstream/buildroot/bin/node+0x18946bc) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#17 0x56232dec6052 in node::AsyncWrap::MakeCallback(v8::Local<v8::Function>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x18c6052) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#18 0x56232e2221a5 in node::http2::Http2Session::HandleHeadersFrame(nghttp2_frame const*) (/home/user/node-upstream/buildroot/bin/node+0x1c221a5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#19 0x56232e213475 in node::http2::Http2Session::OnFrameReceive(nghttp2_session*, nghttp2_frame const*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c13475) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#20 0x5623311b25b6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb25b6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#21 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#22 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#23 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#24 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#25 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#26 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#27 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#28 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#29 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#30 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
previously allocated by thread T0 here:
#0 0x56232de2ebbc in realloc /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x56232e2543f1 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::ReallocImpl(void*, unsigned long, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c543f1) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119d997 in nghttp2_session_open_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9d997) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311a4652 in nghttp2_session_on_request_headers_received (/home/user/node-upstream/buildroot/bin/node+0x4ba4652) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x5623311b2148 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb2148) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#5 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#9 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#10 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#11 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#12 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#13 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#14 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba) in nghttp2_session_mem_recv2
Shadow bytes around the buggy address:
0x50d000002500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50d000002580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50d000002600: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
0x50d000002680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50d000002700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x50d000002780: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x50d000002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==988776==ABORTING

                      Additional information
                      The crash is reproduced in versions 25.x, 24.x, 22.x, 20.x.
                      I suggest patch node-fix-http2-uaf.patch
                      https://hackerone.com/reports/3584453
                      Metadata
                      Metadata
                      Assignees
                      No one assigned
                        Labels
                        No labels
                        No labels
                        Type
                        No type
                        Projects
                        No projects
                          Milestone
                          No milestone
                          Relationships
                          None yet
                          Development
                          No branches or pull requests
                          Issue actions
                          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

                          Skip to content
                          Use-after-free error in http2 server #64113
                          Closed
                          #64166
                          Closed
                          Use-after-free error in http2 server#64113
                          #64166
                          Description
                          @Eusgor
                          Eusgor
                          opened on Jun 24, 2026
                          Version
                          22.23.1
                          Platform
                          Linux host-73 6.12.74-6.12-alt1 #1 SMP PREEMPT_DYNAMIC Fri Mar 6 13:49:54 UTC 2026 x86_64 GNU/Linux

                          Subsystem
                          No response
                          What steps will reproduce the bug?
                          1. Build node.js with asan. Use clang19.1 (Also reproducible with clang17 and clang21.1).
                          $ cd node
$ export CC=clang-19 CXX=clang++-19
$ export CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address"
$ ./configure --prefix=$(pwd)/buildroot --enable-asan
$ make install

                          1. Running JS script test.js
                          ./buildroot/bin/node test.js

                          1. Run command in another terminal.
                          netcat localhost 8000 < crash.txt

                          File crash.txt
                          How often does it reproduce? Is there a required condition?
                          Always
                          What is the expected behavior? Why is that the expected behavior?
                          There should be no use-after-free error.
                          What do you see instead?
                          =================================================================
==988776==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d0000027c4 at pc 0x5623311b4bc7 bp 0x7ffd4e856af0 sp 0x7ffd4e856ae8
READ of size 1 at 0x50d0000027c4 thread T0
#0 0x5623311b4bc6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#1 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#5 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#6 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#7 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#8 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#9 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#10 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#11 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#12 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#13 0x7fd87303fd44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#14 0x56232dd8f530 in _start (/home/user/node-upstream/buildroot/bin/node+0x178f530) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
0x50d0000027c4 is located 132 bytes inside of 144-byte region [0x50d000002740,0x50d0000027d0)
freed by thread T0 here:
#0 0x56232de2e536 in free /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x56232e254245 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::FreeImpl(void*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c54245) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119e3ad in nghttp2_session_close_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9e3ad) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311aac9d in session_close_stream_on_goaway nghttp2_session.c
#4 0x5623311a3281 in session_after_frame_sent1 nghttp2_session.c
#5 0x56233119ed9a in nghttp2_session_mem_send (/home/user/node-upstream/buildroot/bin/node+0x4b9ed9a) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e21d978 in node::http2::Http2Session::SendPendingData() (/home/user/node-upstream/buildroot/bin/node+0x1c1d978) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e220b35 in node::http2::Http2Stream::SubmitRstStream(unsigned int) (/home/user/node-upstream/buildroot/bin/node+0x1c20b35) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e2354b2 in node::http2::Http2Stream::RstStream(v8::FunctionCallbackInfo<v8::Value> const&) (/home/user/node-upstream/buildroot/bin/node+0x1c354b2) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#9 0x5622d048f5e1 in Builtins_CallApiCallbackGeneric embedded.o
#10 0x5622d048d8dd in Builtins_InterpreterEntryTrampoline embedded.o
#11 0x5622d048b4db in Builtins_JSEntryTrampoline embedded.o
#12 0x5622d048b202 in Builtins_JSEntry embedded.o
#13 0x56232eb6aec5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) execution.cc
#14 0x56232eb69468 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) (/home/user/node-upstream/buildroot/bin/node+0x2569468) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e8206cd in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x22206cd) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x56232de946bc in node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) (/home/user/node-upstream/buildroot/bin/node+0x18946bc) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#17 0x56232dec6052 in node::AsyncWrap::MakeCallback(v8::Local<v8::Function>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x18c6052) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#18 0x56232e2221a5 in node::http2::Http2Session::HandleHeadersFrame(nghttp2_frame const*) (/home/user/node-upstream/buildroot/bin/node+0x1c221a5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#19 0x56232e213475 in node::http2::Http2Session::OnFrameReceive(nghttp2_session*, nghttp2_frame const*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c13475) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#20 0x5623311b25b6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb25b6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#21 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#22 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#23 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#24 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#25 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#26 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#27 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#28 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#29 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#30 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
previously allocated by thread T0 here:
#0 0x56232de2ebbc in realloc /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x56232e2543f1 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::ReallocImpl(void*, unsigned long, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c543f1) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119d997 in nghttp2_session_open_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9d997) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311a4652 in nghttp2_session_on_request_headers_received (/home/user/node-upstream/buildroot/bin/node+0x4ba4652) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x5623311b2148 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb2148) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#5 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#9 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#10 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#11 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#12 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#13 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#14 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba) in nghttp2_session_mem_recv2
Shadow bytes around the buggy address:
0x50d000002500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50d000002580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50d000002600: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
0x50d000002680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50d000002700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x50d000002780: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x50d000002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==988776==ABORTING

                          Additional information
                          The crash is reproduced in versions 25.x, 24.x, 22.x, 20.x.
                          I suggest patch node-fix-http2-uaf.patch
                          https://hackerone.com/reports/3584453
                          Metadata
                          Metadata
                          Assignees
                          No one assigned
                            Labels
                            No labels
                            No labels
                            Type
                            No type
                            Projects
                            No projects
                              Milestone
                              No milestone
                              Relationships
                              None yet
                              Development
                              No branches or pull requests
                              Issue actions
                              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                              Skip to content
                              Use-after-free error in http2 server #64113
                              Closed
                              #64166
                              Closed
                              Use-after-free error in http2 server#64113
                              #64166
                              Description
                              @Eusgor
                              Eusgor
                              opened on Jun 24, 2026
                              Version
                              22.23.1
                              Platform
                              Linux host-73 6.12.74-6.12-alt1 #1 SMP PREEMPT_DYNAMIC Fri Mar 6 13:49:54 UTC 2026 x86_64 GNU/Linux

                              Subsystem
                              No response
                              What steps will reproduce the bug?
                              1. Build node.js with asan. Use clang19.1 (Also reproducible with clang17 and clang21.1).
                              $ cd node
$ export CC=clang-19 CXX=clang++-19
$ export CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address"
$ ./configure --prefix=$(pwd)/buildroot --enable-asan
$ make install

                              1. Running JS script test.js
                              ./buildroot/bin/node test.js

                              1. Run command in another terminal.
                              netcat localhost 8000 < crash.txt

                              File crash.txt
                              How often does it reproduce? Is there a required condition?
                              Always
                              What is the expected behavior? Why is that the expected behavior?
                              There should be no use-after-free error.
                              What do you see instead?
                              =================================================================
==988776==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d0000027c4 at pc 0x5623311b4bc7 bp 0x7ffd4e856af0 sp 0x7ffd4e856ae8
READ of size 1 at 0x50d0000027c4 thread T0
#0 0x5623311b4bc6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#1 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#5 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#6 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#7 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#8 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#9 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#10 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#11 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#12 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#13 0x7fd87303fd44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
#14 0x56232dd8f530 in _start (/home/user/node-upstream/buildroot/bin/node+0x178f530) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
0x50d0000027c4 is located 132 bytes inside of 144-byte region [0x50d000002740,0x50d0000027d0)
freed by thread T0 here:
#0 0x56232de2e536 in free /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x56232e254245 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::FreeImpl(void*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c54245) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119e3ad in nghttp2_session_close_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9e3ad) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311aac9d in session_close_stream_on_goaway nghttp2_session.c
#4 0x5623311a3281 in session_after_frame_sent1 nghttp2_session.c
#5 0x56233119ed9a in nghttp2_session_mem_send (/home/user/node-upstream/buildroot/bin/node+0x4b9ed9a) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e21d978 in node::http2::Http2Session::SendPendingData() (/home/user/node-upstream/buildroot/bin/node+0x1c1d978) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e220b35 in node::http2::Http2Stream::SubmitRstStream(unsigned int) (/home/user/node-upstream/buildroot/bin/node+0x1c20b35) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e2354b2 in node::http2::Http2Stream::RstStream(v8::FunctionCallbackInfo<v8::Value> const&) (/home/user/node-upstream/buildroot/bin/node+0x1c354b2) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#9 0x5622d048f5e1 in Builtins_CallApiCallbackGeneric embedded.o
#10 0x5622d048d8dd in Builtins_InterpreterEntryTrampoline embedded.o
#11 0x5622d048b4db in Builtins_JSEntryTrampoline embedded.o
#12 0x5622d048b202 in Builtins_JSEntry embedded.o
#13 0x56232eb6aec5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) execution.cc
#14 0x56232eb69468 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) (/home/user/node-upstream/buildroot/bin/node+0x2569468) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e8206cd in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x22206cd) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x56232de946bc in node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) (/home/user/node-upstream/buildroot/bin/node+0x18946bc) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#17 0x56232dec6052 in node::AsyncWrap::MakeCallback(v8::Local<v8::Function>, int, v8::Local<v8::Value>*) (/home/user/node-upstream/buildroot/bin/node+0x18c6052) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#18 0x56232e2221a5 in node::http2::Http2Session::HandleHeadersFrame(nghttp2_frame const*) (/home/user/node-upstream/buildroot/bin/node+0x1c221a5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#19 0x56232e213475 in node::http2::Http2Session::OnFrameReceive(nghttp2_session*, nghttp2_frame const*, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c13475) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#20 0x5623311b25b6 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb25b6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#21 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#22 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#23 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#24 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#25 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#26 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#27 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#28 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#29 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#30 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
previously allocated by thread T0 here:
#0 0x56232de2ebbc in realloc /usr/src/RPM/BUILD/llvm-project-19/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
#1 0x56232e2543f1 in node::mem::NgLibMemoryManager<node::http2::Http2Session, nghttp2_mem>::ReallocImpl(void*, unsigned long, void*) (/home/user/node-upstream/buildroot/bin/node+0x1c543f1) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#2 0x56233119d997 in nghttp2_session_open_stream (/home/user/node-upstream/buildroot/bin/node+0x4b9d997) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#3 0x5623311a4652 in nghttp2_session_on_request_headers_received (/home/user/node-upstream/buildroot/bin/node+0x4ba4652) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#4 0x5623311b2148 in nghttp2_session_mem_recv2 (/home/user/node-upstream/buildroot/bin/node+0x4bb2148) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#5 0x56232e21f5bb in node::http2::Http2Session::ConsumeHTTP2Data() (/home/user/node-upstream/buildroot/bin/node+0x1c1f5bb) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#6 0x56232e22952d in node::http2::Http2Session::OnStreamRead(long, uv_buf_t const&) (/home/user/node-upstream/buildroot/bin/node+0x1c2952d) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#7 0x56232e529787 in node::LibuvStreamWrap::OnUvRead(long, uv_buf_t const*) (/home/user/node-upstream/buildroot/bin/node+0x1f29787) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#8 0x56232e52b15b in node::LibuvStreamWrap::ReadStart()::$_1::__invoke(uv_stream_s*, long, uv_buf_t const*) stream_wrap.cc
#9 0x5623304b42b5 in uv__read /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1148:7
#10 0x5623304b42b5 in uv__stream_io /home/user/node-upstream/out/../deps/uv/src/unix/stream.c:1208:5
#11 0x5623304ca285 in uv__io_poll /home/user/node-upstream/out/../deps/uv/src/unix/linux.c:1565:11
#12 0x562330491d74 in uv_run /home/user/node-upstream/out/../deps/uv/src/unix/core.c:460:5
#13 0x56232de95cc5 in node::SpinEventLoopInternal(node::Environment*) (/home/user/node-upstream/buildroot/bin/node+0x1895cc5) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#14 0x56232e262173 in node::NodeMainInstance::Run() (/home/user/node-upstream/buildroot/bin/node+0x1c62173) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#15 0x56232e0b0d59 in node::Start(int, char**) (/home/user/node-upstream/buildroot/bin/node+0x1ab0d59) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba)
#16 0x7fd87303fc8b (/lib64/libc.so.6+0x27c8b) (BuildId: 22555ae827f9b29f1149acf2fe0887aa8760c393)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/node-upstream/buildroot/bin/node+0x4bb4bc6) (BuildId: df6b9d521bc7b2f5efc4da3bfff2263a777088ba) in nghttp2_session_mem_recv2
Shadow bytes around the buggy address:
0x50d000002500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50d000002580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50d000002600: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00
0x50d000002680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50d000002700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x50d000002780: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x50d000002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50d000002a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==988776==ABORTING

                              Additional information
                              The crash is reproduced in versions 25.x, 24.x, 22.x, 20.x.
                              I suggest patch node-fix-http2-uaf.patch
                              https://hackerone.com/reports/3584453
                              Metadata
                              Metadata
                              Assignees
                              No one assigned
                                Labels
                                No labels
                                No labels
                                Type
                                No type
                                Projects
                                No projects
                                  Milestone
                                  No milestone
                                  Relationships
                                  None yet
                                  Development
                                  No branches or pull requests
                                  Issue actions