Releasing updates for sixteen security flaws on Thursday the Node.js project patched vulnerabilities across its 22.x, 24.x, and 26.x release lines.
Seven of the vulnerabilities are rated high, six medium, and three low, according to the official advisory. The patched builds are version 22.23.5, version 24.22.3, and version 26.13.1. The update also refreshes three bundled parts: llhttp, undici, and sqlite.
Most of the list involves HTTP/2 code. Unauthenticated clients can crash default servers and trigger memory leaks.
Client Can Abort Default HTTP/2 Server
CVE-2026-123863 lets any client abort a default HTTP/2 server. It is a variant of CVE-2024-27983 that the older fix missed, according to CyberSecurityNews. The crash flaw needs only a default HTTP/2 server that replies before the request body has fully arrived. The Node.js project calls that behavior typical. The crash works over both TLS and cleartext connections.
A second HTTP/2 flaw, CVE-2026-123866, affects all three lines. From versions 24.22.0 and 26.9.0 onward, a client alone can trigger it. For builds on version 22.x alongside older 24.x and 26.x releases, this can still be activated when the server itself terminates a stream mid-response, such as following an idle timeout.
A separate flaw in Node.js HTTPS servers, CVE-2026-123864, allows an unauthenticated client to read memory from other connections. The Node.js project said that the bug can expose TLS private keys and other users’ requests.
Only servers where a handler invokes res.flushHeaders() early and subsequently finishes with a non-empty chunk face this vulnerability.
High-Severity Vulnerability List
- CVE-2026-123865: Across all three lines, any client can force default HTTP/2 servers to persistently retain memory and file descriptors.
- CVE-2026-123874: When files are served using
stream.respondWithFile()orstream.respondWithFD()on 24.x and 26.x, a client has the ability to damage server memory. - CVE-2026-126051: A client can crash a TLS server running on 24.x and 26.x whenever that server utilizes
server.addContext()or theSNICallback,OCSPRequest,newSession, orresumeSessionhooks. - CVE-2026-123872: When a TLS server enforces stricter client-certificate policies for specific hostnames, a client authorized under a different hostname can bypass those rules during TLS 1.2 renegotiation and transition to a stricter one.
Canceling downloads on respondWithFile() or respondWithFD() streams can also crash the server under CVE-2026-123875, which is rated medium.
Fixes Reported by Multiple Researchers
Matteo Collina fixed most of the vulnerabilities. Based on the advisory, Chris Rohlf—working alongside Claude and Anthropic Research—disclosed five of the security flaws, which include CVE-2026-123863 and CVE-2026-123864. Other reporters include Pimterry, Trail of Bits, and several independent researchers.
End-of-life lines, including 20.x and 25.x, receive no fix in this release, and the project notes such versions remain affected. Public HTTP/2 and HTTPS servers should upgrade first.
The project’s security advisory states that upgrading to the specific fixed version for each line is the sole remedy available.
Node.js issues significant security patches nearly every month, as demonstrated by the Node2Shell Brotli bug in October and the 11 fixes in July.
Public HTTP/2 and HTTPS servers should go first.
