Node.js has released security updates for its 26.x, 24.x, and 22.x lines that fix 16 vulnerabilities, including an HTTPS flaw that lets an unauthenticated client read another connection’s memory, including TLS private keys.
The fixed versions are Node.js 26.13.1, 24.22.3 and 22.23.5, all shipped on November 11. The Node.js advisory rates seven of the 16 flaws as High, six as Medium, and three as Low. Most of the High-rated bugs are in the HTTP/2 and TLS server code, and several can be triggered by a remote client without credentials.
The release follows the advance notice Node.js published on November 3, which gave only the date and the top severity rating. It also lands three weeks after the October 21 release that fixed Node2Shell (CVE-2026-111497), the Brotli decoder flaw.
As of November 11, Node.js has published no CVSS scores for the new CVEs and lists no workarounds, so upgrading is the only fix it offers.
How the Node.js HTTPS Memory Leak CVE-2026-123864 Works
CVE-2026-123864 is a re-entrancy bug in Node.js’s handling of TLS writes within the HTTP parser. When asked to write zero bytes, TLSWrap::DoWrite() immediately calls ClearOut(), which decrypts the next incoming TLS record. If that empty write comes from JavaScript running inside the parser’s on_body callback, the parser is re-entered mid-body, which causes a use-after-free and an out-of-bounds heap read.
The server then copies that freed or unrelated heap memory into the request body. Node.js says the leaked data can include TLS private keys and other users’ requests. To trigger the bug, an application must call res.flushHeaders() before the request body ends and later call res.end() with a non-empty chunk. To read the leaked memory, an attacker needs any ordinary route that echoes or stores a request body.
CVE-2026-123864 affects all three supported lines but only HTTPS servers. Cleartext node:http is not affected. The fix, credited to Matteo Collina, stops empty writes from re-entering the parser.
The Other High-Severity HTTP/2 and TLS Flaws
Four of the remaining six High-rated bugs are in the HTTP/2 server. CVE-2026-123863 lets any unauthenticated client crash a default HTTP/2 server over TLS or cleartext. The client creates a stream that still leaves header memory out of scope after its session ends, so a memory-accounting check fails when the session is destroyed, and the process aborts. Node.js calls it a variant of CVE-2024-27983 that the earlier fix missed. It affects 24.x and 26.x.
CVE-2026-123866 can send freed response memory, including other connections’ response buffers, to a peer. It triggers when a stream is torn down while a write is still pending.
On Node.js 26.9.0 or later, and on 24.22.0 or later, a remote peer can force the teardown on its own. On all three lines, the same bug can also be reached through a teardown the application starts itself, such as a per-stream idle timeout.
CVE-2026-123874 lets an unauthenticated client corrupt server memory in applications that serve files with respondWithFile() or respondWithFD(). Resetting the stream during a pending write frees the stream object, and the server later makes a virtual call through it. CVE-2026-123865, an incomplete fix of CVE-2026-48937, lets a client send GOAWAY and then trigger a protocol error during shutdown. Each connection it does this to then holds server memory and a file descriptor indefinitely.
The other two High-rated flaws are in TLS. CVE-2026-123872 lets a client authenticated for one hostname renegotiate a TLS 1.2 connection under a different server name. It carries its client certificate authentication to a host with a stricter policy. CVE-2026-126051 lets a remote client crash TLS servers that use the SNICallback, OCSPRequest, newSession or resumeSession hooks, or server.addContext(). It affects 24.x and 26.x.
Five Node.js Flaws Credited to Claude and Anthropic Research
Node.js credits five of the 16 CVEs to Chris Rohlf “in collaboration with Claude and Anthropic Research.” There are three High-rated bugs (CVE-2026-123863, CVE-2026-123864, and CVE-2026-123874), the Medium-rated CVE-2026-123875, and the Low-rated CVE-2026-123862. Neither Node.js nor Anthropic has published a technical write-up on how they were found.
Tim Perry, credited as pimterry, reported three High-rated flaws (CVE-2026-123865, CVE-2026-126051 and CVE-2026-123872) and wrote the TLS fixes himself. Node.js credits the Low-rated fs.watch Permission Model bug to Trail of Bits (OpenAI). Matteo Collina wrote most of the other fixes.
Medium and Low Severity Fixes
Among the Medium-rated issues, CVE-2026-123868 lets an HTTP/2 client fill server memory past the maxSessionMemory limit. Node.js says the server retains about 114 bytes for each one-byte data frame that costs the attacker about 10 bytes to send. CVE-2026-123875 crashes HTTP/2 servers that serve files when a client cancels a handful of downloads, and CVE-2026-123828 is a one-byte heap overflow in session.altsvc() triggered by a long :authority header.
Two Medium-rated flaws weaken certificate checks. CVE-2026-123867 lets a client holding a certificate trusted by the default CA complete mutual TLS to a hostname protected by a separate CA. It applies when that hostname’s SNI context has no server certificate. CVE-2026-123877 lets https.Agent reuse a TLS session from the default trust store for a later request that sets ca: []. CVE-2026-123871 stops proxy usernames and passwords from appearing in ERR_PROXY_INVALID_CONFIG error messages, four error paths the fix for CVE-2026-48615 missed.
The three Low-rated bugs cover a recursive fs.watch leak of denied file names on macOS and Windows, a zlib crash after params() and destroy(), and CVE-2026-106071. That last one is a Permission Model wildcard over-grant first fixed in 26.x on October 21, and the November advisory now lists it for 22.x and 24.x as well.
Is the November 2026 Node.js Release Being Exploited?
The Node.js advisory does not report exploitation of any of the 16 CVEs, and as of November 11, Cyber Kendra found no public proof-of-concept code for them. Node.js has not published CVSS vectors either. Under its disclosure policy, CVE records can take a few days to appear after a security release because disclosure runs through HackerOne.
Disclosure has narrowed the gap between patch and exploit for Node.js bugs before. After the October release, public proof-of-concept code for Node2Shell appeared within about a day, according to Sysdig. The November advisory describes several bugs in enough detail to show how they are triggered.
What Node.js Users Should Do Now
Upgrade to Node.js 26.13.1, 24.22.3 or 22.23.5, then restart every Node.js process, since a running process keeps the old runtime in memory. Run node --version on each host, container, and CI runner to confirm the new build. Container images pinned to an older Node.js tag need to be rebuilt.
The release notes for all three lines also update llhttp to 9.4.4 and SQLite to 3.54.1. Node.js 24.22.3 and 26.13.1 also update the bundled Brotli library to 1.2.1 and Undici to 7.30.2 and 8.12.4, respectively. The 22.23.5 notes also include the fixes for four HTTP/2 bugs that the advisory lists only for 24.x and 26.x. All three sets of release notes reference a 17th identifier, CVE-2026-123873, a Low-rated Permission Model fix for heap snapshot destinations that the advisory does not describe.
Node.js 20 and Node.js 25 are end-of-life and receive no fixes, even though Node.js says end-of-life versions are always affected by security releases. The Node.js end-of-life page lists HeroDevs, NodeSource, and TuxCare as commercial sources of patches for retired lines. Anyone upgrading from 22.x or 24.x to 26.x should note that official Linux binaries have linked against libatomic since Node.js 25, which may need to be installed separately.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
