Node.js fixes 16 flaws, seven high, in its three supported lines

Node.js fixes 16 flaws, seven high, in its three supported lines

11 November 2026: The Node.js project has shipped 22.23.5, 24.22.3 and 26.13.1 to fix 16 vulnerabilities, seven rated high, most of them in the HTTP/2 and TLS code that every public-facing Node server depends on. One of the high-rated bugs lets an unauthenticated client read memory belonging to other connections on an HTTPS server, including TLS private keys.

Not yet independently verified. The Node.js post gives severity words only, with no CVSS scores, and says nothing about exploitation; we found no independent analysis of the flaws yet. We will update this when it can be confirmed, and remove this note.

The HTTPS bug that can hand out private keys

CVE-2026-123864 is a re-entrancy flaw. When a zero-byte TLS write is issued from JavaScript running inside the HTTP parser's body callback, Node decrypts the next TLS record while the parser is still mid-body, re-enters the parser and ends up copying freed or unrelated heap memory into the request body. The project says that memory can include other users' requests and TLS private keys. Triggering it needs a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk; reading the leak needs any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. All three supported lines, 22.x, 24.x and 26.x, are.

The second TLS problem is an authentication bypass. Under CVE-2026-123872, a client using TLS 1.2 renegotiation can change the server name on its own and so get past client certificate authentication. A server that relies on mutual TLS per host name should treat this one as the priority. A related medium-rated flaw, CVE-2026-123867, makes CA-only SNI overrides of the client CA list fail open, which also weakens per-host mTLS.

Five more highs in HTTP/2 and TLS servers

• CVE-2026-123863 (24.x and 26.x): any unauthenticated client can abort a default HTTP/2 server through a failed assertion when the session is torn down. The project calls it a variant of CVE-2024-27983 that the earlier fix missed.
• CVE-2026-123865 (all lines): a protocol error during shutdown leaves an HTTP/2 session dangling, so memory and file descriptors leak for good. It completes an earlier, partial fix.
• CVE-2026-123866 (all lines): HTTP/2 stream teardown can send freed response memory to the peer.
• CVE-2026-126051 (24.x and 26.x): a remotely triggered uncaught exception in TLS servers through deferred handshake callbacks.
• CVE-2026-123874 (24.x and 26.x): a use-after-free when a respondWithFile() stream is reset during a pending write.

The six medium flaws include a heap overflow in session.altsvc() with a long origin, proxy credentials leaking into ERR_PROXY_INVALID_CONFIG error messages, and a certificate validation bypass in https.Agent through TLS session reuse across policies. The three low ones sit in the permission model and in zlib. The release also updates llhttp on all three lines, undici on 24.x and 26.x, and sqlite on 22.x and 24.x.

Older runtimes get no patch

The project repeats its standing warning that end-of-life versions are always affected when a security release ships. Anything still on Node 20 or earlier has no fixed build for these bugs and has to move to a supported line. Container images and platform runtimes that pin a Node version, from serverless functions to build agents, need the new patch level pulled in explicitly; a rebuild on an old base image keeps the vulnerable binary.

The previous Node.js security release came on 21 October.

Related on TrustList:

• Node.js fixes a Brotli remote code flaw and two TLS hostname bypasses
• Deno joins Cloudflare: Deno Deploy shuts down in six months
• Brotli fixes a critical decoder flaw that reaches far beyond Node.js

Sources

• Node.js blog: Wednesday, November 11, 2026 Security Releases, 11 November 2026
• Node.js blog: Node.js v24.22.3 (LTS) release notes, 11 November 2026