On November 11, 2026, the Node.js Project released crucial security updates to address vulnerabilities across its 26.x, 24.x, and 22.x lines, marking a significant effort to enhance the platform’s security and stability. The updates are particularly notable for their attention to 16 identified vulnerabilities, categorized by severity into 7 high, 6 medium, and 3 low risk. These vulnerabilities present various risks to system integrity, with many capable of being triggered remotely by unauthenticated users, thus amplifying the urgency for security measures.
A notable concentration of the vulnerabilities pertains to HTTP/2 and TLS (Transport Layer Security) handling. The newly patched versions are v22.23.5, v24.22.3, and v26.13.1. In addition to addressing these vulnerabilities, the release also features updates to other components including llhttp, undici, and sqlite. The swift response from the Node.js Project is particularly important considering the escalating landscape of cyber threats affecting web applications.
Node.js Patches 16 Security Vulnerabilities
According to an official report from Node.js Security, some of the vulnerabilities are notably severe and could potentially allow attackers to crash servers or gain unauthorized access to sensitive memory data. One of the most alarming vulnerabilities is labeled CVE-2026-123863, which affects HTTP/2 session teardown. This flaw enables any client to prematurely terminate a default server across the 24.x and 26.x versions, representing a significant concern for developers and operators relying on these frameworks.
This vulnerability is a variant of CVE-2024-27983, indicating that the previous patch had overlooked this specific exploit. Another critical vulnerability, CVE-2026-123864, is categorized as a re-entrancy bug in the HTTPS protocol, which poses a risk of leaking memory data from other connections. This breach can expose vital information, including TLS private keys, affecting versions 22.x, 24.x, and 26.x. These findings follow an earlier batch of fixes released in October, which already addressed a pivotal Brotli remote code execution (RCE) vulnerability.
In addition to these high-severity vulnerabilities, other issues encompass risks related to resource exhaustion, crashes, and heap corruption. For example, CVE-2026-123866 identifies a use-after-free problem in HTTP/2 stream teardown, allowing the potentially dangerous sending of freed memory to an external peer. Another severity flaw, CVE-2026-123865, enables clients to leak memory and file descriptors endlessly by exploiting a protocol error that arises during the shutdown process. This issue is described as an incomplete fix for CVE-2026-48937, with similar session-cleanup vulnerabilities having been reported in a prior June release.
CVE-2026-126051 allows an attacker to bring down TLS servers using various functions, including SNICallback and OCSPRequest, whereas CVE-2026-123874 corrupts memory in servers relying on the respondWithFile() or respondWithFD() functions. Notably, two identified flaws also bypass client-certificate authentication. CVE-2026-123872 allows a client to alter the server name during TLS 1.2 renegotiation, thereby carrying its credentials over to a more secure host, which raises glaring security concerns.
Furthermore, CVE-2026-123867 allows a failure to restrict client access based on the default certificate authority (CA), indicating that a client possessing a default-CA certificate could potentially connect to a host that should have restricted access. In a troubling trend, CVE-2026-123877 permits a TLS session, cached under the default trust store, to be reused under stricter policies, symbolizing a recurring vulnerability pattern within JavaScript stacks.
The medium-severity vulnerabilities also comprise a one-byte heap overflow in session.altsvc() (CVE-2026-123828) and a memory exhaustion issue in HTTP/2, identified as CVE-2026-123868, which allows queued inbound data to bypass established maximum memory limits. Another aforementioned vulnerability, CVE-2026-123875, leads to server crashes when a file download is aborted by a client. Furthermore, CVE-2026-123871 exposes proxy credentials through ERR_PROXY_INVALID_CONFIG messages, potentially compromising server security.
Overall, three low-severity vulnerabilities were also included in this security update, with two relating to the Permission Model and one being an uncatchable assertion in the zlib component. These vulnerabilities underscore the complexities of ensuring security in a popular and widely adopted platform such as Node.js.
The discovery and reporting of many of these vulnerabilities are credited to cybersecurity researchers, including Chris Rohlf, Claude, and members from Anthropic Research, with additional contributions from researchers like pimterry, aidan02, and Trail of Bits. The Node.js maintainers—mcollina, RafaelGSS, and jasnell—were instrumental in developing fixes for these identified flaws.
In light of these developments, administrators are urged to implement the updates immediately and restart their services, as end-of-life versions remain vulnerable to these risks. For teams that are unable to apply the patches right away, it is recommended to limit the public exposure of HTTP/2 and file-servicing endpoints and to avoid reflecting :authority values into the altsvc() function. The urgency of these actions is heightened by warnings from CISA (Cybersecurity and Infrastructure Security Agency) regarding the active exploitation of vulnerabilities in the Node.js environment, emphasizing the need for prompt action to protect systems from potential threats.
Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs: