CVE-2026-85024: Js Node Stream Removealllisteners Without Destroy
removeAllListeners() detaches every listener from this stream, including the 'error' listener, while the stream itself is left running. If the stream still holds buffered input (or receives more bytes from a remote peer) it can emit 'error' with no listener attached; Node.js escalates an 'error' event with no listener into an uncaught exception and terminate
JSgreprules fetch cve-2026-85024-js-node-stream-removealllisteners-without-destroy --engine opengrepDescription
removeAllListeners() detaches every listener from this stream, including the 'error' listener, while the stream itself is left running. If the stream still holds buffered input (or receives more bytes from a remote peer) it can emit 'error' with no listener attached; Node.js escalates an 'error' event with no listener into an uncaught exception and terminate
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.