Node.js fixes 16 flaws, including HTTP/2 bugs that crash servers and leak memory

Node.js issued coordinated security updates on Nov. 11, 2026 across all three supported release lines (22.x, 24.x and 26.x), fixing 16 vulnerabilities, seven of them rated High, with the most serious flaw carrying a High rating on every line.

CVE-2026-123863 lets an unauthenticated client crash a server running Node.js’s built-in HTTP/2 on the 24.x and 26.x lines. The trigger is a default server that replies before the complete request body arrives, a pattern the project calls typical, and the flaw works over TLS as well as cleartext.

CVE-2026-123866 can make a server return pieces of its own memory to a client, including responses intended for other connections, across all three supported lines. On builds from 24.22.0 and 26.9.0 onward, one client acting alone can trigger it; on 22.x and older 24.x and 26.x builds, it fires when the server terminates a stream mid-response, such as after an idle timeout.

CVE-2026-123864 lets an unauthenticated client read other connections’ memory on Node.js HTTPS servers, including TLS private keys and other users’ request data, across all three supported lines, per the Node.js project. It does not affect plain HTTP servers built with node:http. Exploitation needs a handler that calls res.flushHeaders() while the request body is still arriving and then calls res.end() with data, plus an endpoint that sends back or retains a request body. The project described the exposed data as “including TLS private keys and other users’ requests.”

These HTTP/2, HTTPS and TLS flaws live in Node.js’s own server code, so they matter wherever a Node.js process accepts those connections directly.

Four of the seven high-rated flaws are CVE-2026-123865, CVE-2026-123874, CVE-2026-126051 and CVE-2026-123872. CVE-2026-123865 lets a client compel any default HTTP/2 server across all three supported lines to hold onto memory and file descriptors (handles to open files or network connections) indefinitely. On the 24.x and 26.x lines, CVE-2026-123874 lets a client corrupt server memory when the server serves files with stream.respondWithFile() or stream.respondWithFD(); when a TLS server on those lines relies on SNICallback, OCSPRequest, the newSession and resumeSession hooks, or server.addContext(), CVE-2026-126051 lets a client crash it.

CVE-2026-123872 affects all three lines. On a TLS server that applies tighter client-certificate rules to certain hostnames, a client cleared for one hostname can reach a more restrictive hostname during TLS 1.2 renegotiation without meeting those rules. Rated medium, CVE-2026-123875 lets canceling a file download crash a server on all three lines.

The advisory records no attacks exploiting the fixed flaws. It does not state whether servers exposed to the flaw must replace TLS keys or other secrets once patched. The project credits Chris Rohlf, working with Claude and Anthropic Research, for reporting five flaws, including CVE-2026-123863 and CVE-2026-123864.

Thetechhacker Global Solutions’ Nov. 10, 2026 upgrade guide says teams on 22.x, 24.x or 26.x can stay within their own line and update to the patched release rather than jump to a major version. Teams should update the Node version listed in CI workflows, Docker base images and package.json engines fields, plus hosting settings, then run the complete test suite before deploying. The guide also says the release due Nov. 11 includes a leading issue rated High across all three supported lines without naming that issue.

The project says end-of-life lines such as 20.x and 25.x are always affected and receive no fix. Node.js 20 reached end-of-life on April 30, 2026, and Node.js 25 ended on June 1, 2026. Node.js 26 entered Active LTS on Oct. 28, 2026, while Node.js 24 entered Active LTS on Oct. 28, 2025 and moved to Maintenance on Oct. 20, 2026. Node.js 22 remains the oldest supported line still patched.

Node.js 26 was first released on May 5, 2026. Support ends April 30, 2027, for the 22 line, April 30, 2028, for the 24 line, and April 30, 2029, for the 26 line, which moves to Maintenance on Oct. 20, 2027.

The fixed releases are 22.23.5, 24.22.3 and 26.13.1 — 22.23.5 for the 22.x line, 24.22.3 for the 24.x line and 26.13.1 for the 26.x line. Updating is the sole fix for servers on 22.x, 24.x or 26.x, and the advisory offers no workaround for servers unable to update yet.