Node.js has shipped security releases that fix 16 vulnerabilities across its three supported release lines, including a flaw that can leak another connection’s memory, including TLS private keys, from an HTTPS server. The releases, published on 11 November 2026, are v22.23.5, v24.22.3 and v26.13.1, and anyone running an earlier build on those lines should upgrade now.

Seven of the 16 flaws are rated High severity, six are rated Medium and three are rated Low. The project pre-announced the release on 3 November, giving only the date and the top severity rating, and published the details on Wednesday. Node.js has not published CVSS scores for the new flaws, and it has not reported any exploitation in the wild.

The most serious flaw: CVE-2026-123864

The headline flaw is CVE-2026-123864, a re-entrancy bug in the way Node.js handles TLS writes inside its HTTP parser. A zero-length TLS write on an HTTPS server can cause the parser to run again while it is already processing data, producing a use-after-free that discloses heap memory inside response bodies.

That matters because the leaked memory can belong to other connections. In the worst case it could include TLS private keys and other users’ requests. The flaw affects all three release lines, 22.x, 24.x and 26.x. Plain HTTP servers using node:http over cleartext are not affected, because the bug is specific to the HTTPS path.

Five of the 16 flaws are credited to Chris Rohlf, working with Claude and Anthropic Research, who reported several of the issues in this batch. The project’s release notes also update bundled dependencies, including the llhttp HTTP parser, the undici HTTP client and SQLite.

HTTP/2 flaws that can crash a server

Several of the High-severity flaws sit in Node.js’s HTTP/2 implementation. CVE-2026-123863 is a reachable assertion in HTTP/2 session teardown that lets any unauthenticated client abort the server process, over TLS or cleartext, on the 24.x and 26.x lines. It is a variant of an earlier flaw, CVE-2024-27983, that the previous fix did not fully cover.

Other High-severity issues include further HTTP/2 memory problems, such as a flaw that lets freed response memory be exposed to remote peers, and a use-after-free in HTTP/2 file responses. One further flaw, CVE-2026-123871, means an invalid proxy setting can print the raw proxy URL, credentials included, in an error message that then lands in logs or crash reports.

The flaws can in many cases be triggered remotely by unauthenticated clients, which is why the project rates them High and why upgrading, rather than waiting for a workaround, is the only fix the project offers.

Who is affected and what to do

Anyone running Node.js 22.x below v22.23.5, 24.x below v24.22.3 or 26.x below v26.13.1 is affected by at least some of the flaws. Check the installed version with node -v, then upgrade to the patched build for the line in use and restart every Node.js process, since a running process keeps the old runtime in memory.

Node.js 20 and Node.js 25 are end-of-life and will not receive fixes, even though the project says end-of-life versions are always affected by security releases. Anyone still on those lines should move to a supported release.

Node.js powers a large share of the web’s back-end services, from small tools to large platforms, so a coordinated release fixing 16 flaws at once is worth acting on the same day. The upgrade is a runtime patch, not a package update, so it needs a restart of the services that use it. Sources: GBHackers and Cyber Kendra.