Node.js maintainers have released security updates for the 22.x, 24.x and 26.x release lines, fixing 16 vulnerabilities that include remotely triggerable server crashes, memory leaks and authentication bypasses. The project’s November 11 security notice lists seven high-severity, six medium-severity and three low-severity flaws.
One of the most serious issues, CVE-2026-123864, affects Node.js HTTPS and can let an unauthenticated remote client read memory belonging to other connections. The exposed data can include TLS private keys and other users’ requests. The flaw requires a particular application pattern involving a response handler that flushes headers before the request body ends and later sends a non-empty response chunk. Cleartext node:http servers are not affected by this issue.
Other high-severity bugs include CVE-2026-123863, which can let an unauthenticated HTTP/2 client crash a server; CVE-2026-123865, which can cause HTTP/2 sessions to retain memory and file descriptors; and CVE-2026-123866, which can expose response memory from other connections. The release also fixes CVE-2026-126051, a remotely triggerable crash in certain TLS server configurations, CVE-2026-123872, which can bypass per-host client-certificate checks during TLS 1.2 renegotiation, and CVE-2026-123874, a use-after-free in HTTP/2 file serving.
The 22.x line is affected by 11 of the listed issues, while 24.x and 26.x are affected by all 16. The fixes also update llhttp across all three lines, undici in 24.x and 26.x, and SQLite in 22.x and 24.x. The project notes that end-of-life versions are also affected when a security release is issued.
The patched versions are Node.js 22.23.5, 24.22.3 and 26.13.1. The project lists all affected release lines and vulnerability details in its security announcement.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
