Node.js Releases Security Updates for 14 Vulnerabilities, Including Critical HTTP/2 and TLS Flaws
Hari 
The Node.js project shipped coordinated security releases on November 11, 2026, covering the 22.x, 24.x and 26.x lines with versions v22.23.5, v24.22.3 and v26.13.1.
The update closes a cluster of memory-corruption, resource-exhaustion and authentication-bypass defects concentrated in the HTTP/2 and TLS stacks. It also refreshes the bundled llhttp, undici and sqlite dependencies. The highest severity rating across all three lines is high.
HTTP/2 session and stream teardown accounts for most of the serious findings. CVE-2026-123863 is a reachable CHECK_EQ assertion in ~Http2Session() that lets an unauthenticated client abort the process, and it is a variant that the earlier CVE-2024-27983 fix missed.
Node.js Releases Security Updates
CVE-2026-123865 leaves a dangling session in CLOSE_WAIT when a protocol error fires during shutdown, permanently leaking memory and file descriptors.
CVE-2026-123866 and CVE-2026-123874 are use-after-free conditions that write freed heap memory to the peer or corrupt an Http2Stream through respondWithFile(). Heap lifetime errors of this class also dominated recent browser patch cycles, as seen in Chrome 150’s fixes for four high-severity memory bugs.
The TLS fixes carry the sharpest confidentiality impact. CVE-2026-123864 is a re-entrancy bug in which a zero-length TLSWrap::DoWrite() calls ClearOut() from inside the on_body callback. That re-enters llhttp_execute(), producing a use-after-free and an out-of-bounds heap read that can disclose TLS private keys and other connections’ requests.
CVE-2026-126051 lets a client hello followed by a socket FIN destroy the socket before a deferred SNICallback or OCSPRequest hook runs, raising an uncaught exception that terminates the server.
Two mTLS authorization bypasses, CVE-2026-123872 and CVE-2026-123867, let a client change servername during TLS 1.2 renegotiation, or fall back to the default client CA, to reach protected hostnames.
The medium-rated issues include a one-byte heap overflow in session.altsvc() (CVE-2026-123828) and unaccounted inbound DATA frames that bypass maxSessionMemory (CVE-2026-123868).
Others are a StreamPipe NULL dereference on cancelled downloads (CVE-2026-123875) and a session-cache key collision in https.Agent that carries authentication across CA policies (CVE-2026-123877). Proxy credentials also leak through ERR_PROXY_INVALID_CONFIG messages into container logs and crash-reporting pipelines.
The low-severity items cover Permission Model path disclosure through recursive fs.watch, wildcard radix over-grants, and an uncatchable assertion in zlib params().
Chris Rohlf, working with Claude and Anthropic Research, reported five of the flaws, including the HTTP/2 abort, the TLS heap read and the file-serving use-after-free. This continues the trend of AI-assisted bug discovery outpacing exploit development.
Because HTTP/2 flaws affect the same front-door position that reverse proxies hold, defenders should also review edge infrastructure, as shown by Apache Traffic Server’s batch of ACL bypass and RCE fixes.
Teams should upgrade to the patched builds and rebuild container images, since unsupported end-of-life versions remain affected. Where immediate patching is impossible, restrict HTTP/2 exposure to trusted networks or terminate it at a hardened proxy.
Audit handlers that call flushHeaders() before the request body ends, review per-hostname client-certificate policies, and rotate any TLS private keys served by unpatched HTTPS endpoints.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
