Node.js has released security updates for all three of its supported lines, fixing 17 vulnerabilities, including a serious HTTPS flaw that can leak server memory containing TLS private keys and other users' requests. Versions 26.13.1, 24.22.3 and 22.23.5 were published on Wednesday 11 November 2026, and the project rates the most severe issue in each line as high.

The worst flaw, tracked as CVE-2026-123864, affects every supported line. It is a re-entrancy bug in the way Node.js handles HTTPS connections. When a server writes zero bytes inside the HTTP parser's body callback, Node.js decrypts the next TLS record too early, re-entering the parser and causing a use-after-free and an out-of-bounds heap read. The server can then copy freed or unrelated heap memory into the response for the request body, which the project says can expose memory belonging to other connections, including TLS private keys and other users' requests.

Triggering the flaw needs a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory needs an ordinary route that echoes or stores a request body. Cleartext Node.js HTTP servers are not affected. The flaw was reported by Chris Rohlf in collaboration with Claude and Anthropic Research.

HTTP/2 flaws dominate the release

Most of the remaining high-severity flaws sit in Node.js HTTP/2 handling, and several need no login and work against default settings. CVE-2026-123863 lets any unauthenticated client abort a server by arranging for an HTTP/2 stream to outlive its session, tripping an internal memory assertion and terminating the process. It affects the 24.x and 26.x lines and is a variant of CVE-2024-27983 that an earlier fix did not cover.

CVE-2026-123865 leaves HTTP/2 sessions in memory permanently when a protocol error arrives while a session is already shutting down. The socket stays in CLOSE_WAIT and all of the session state is held indefinitely, at no further cost to the attacker, who can start the shutdown remotely by sending a GOAWAY frame. CVE-2026-123866 is a use-after-free in HTTP/2 stream teardown that can send freed response memory, including the contents of other connections' response buffers, to a peer.

Two further HTTP/2 flaws affect servers that serve files: CVE-2026-123874 can corrupt server memory when a respondWithFile() stream is reset during a pending write, and a one-byte heap buffer overflow in Alt-Svc handling, CVE-2026-123828, can be triggered by a single request carrying a long but valid :authority header. The release also updates the bundled llhttp, undici and SQLite dependencies to address public vulnerabilities.

TLS certificate bypasses fixed

The release also fixes several TLS flaws. CVE-2026-126051 lets a remote, unauthenticated attacker terminate a TLS server process when it uses SNI, OCSP or session hooks, by destroying the socket before a deferred callback runs. CVE-2026-123872 lets a client change the servername during TLS 1.2 renegotiation, carrying its existing client-certificate authentication to a protected host with a stricter policy. A further flaw lets a client authorised for the default hostname reach a protected hostname when the server assigns it a different client-certificate authority but no server certificate in that SNI context.

Lower-severity fixes stop proxy credentials leaking into ERR_PROXY_INVALID_CONFIG error messages, close two gaps in the Permission Model, and fix a crash in the zlib streaming API. No active exploitation of any of the flaws has been reported, and none of the CVEs is in CISA's Known Exploited Vulnerabilities catalog.

Which versions to install

Users should upgrade to Node.js 26.13.1, 24.22.3 or 22.23.5, depending on their release line, and restart every Node.js process. Container images and single executable applications should be rebuilt too. Until patching is possible, the project and security researchers suggest putting HTTP/2 services behind a proxy that terminates HTTP/2, and reviewing any server that applies different client-certificate rules per hostname.

End-of-life versions, including Node.js 20.x, are always affected when a security release occurs and receive no patches, so deployments still on those lines need to move to a supported release. Chris Rohlf reported five of the issues in collaboration with Claude and Anthropic Research, and Matteo Collina wrote most of the fixes.

Frequently asked questions

Which Node.js versions are affected? All users on the active 22.x, 24.x and 26.x lines running versions before 22.23.5, 24.22.3 and 26.13.1 respectively. Some flaws affect only the 24.x and 26.x lines.

Is CVE-2026-123864 being exploited? No attacks have been reported and the flaw is not in CISA's Known Exploited Vulnerabilities catalog, but the project rates it high and the fix should be applied promptly.

Sources: Node.js Project security releases and SecurityOnline analysis.