The Node.js project has released fixes for 16 security flaws across its 22.x, 24.x and 26.x lines. Seven are rated high, six medium, and three low. The patched builds are v22.23.5, v24.22.3 and v26.13.1, and the update also refreshes three bundled parts: llhttp, undici and sqlite.
Remote memory exposure and server crashes
The most serious issue is CVE-2026-123864, which affects the HTTPS code in all three lines. A client with no login can read memory that belongs to other connections, and that memory can contain TLS private keys and other users’ requests. The flaw comes from a re-entry problem: a zero-length TLS write can make Node.js decrypt the next record while the HTTP parser is still reading a body, leading to a use-after-free and an out-of-bounds read.
The server is exposed only if a handler calls res.flushHeaders() early and later ends with a non-empty chunk. Routes that echo or store request bodies give an attacker a way to read the leak. Plain node:http is not affected, according to the Node.js security notes.
HTTP/2 takes up most of the remaining high-severity list. CVE-2026-123863 lets any client abort a default HTTP/2 server and is described as a variant of CVE-2024-27983 that the older fix missed. CVE-2026-123874 and CVE-2026-123875 affect servers that send files with respondWithFile(); one corrupts memory, while the other crashes the server when a download is canceled, and a handful of canceled requests is enough. CVE-2026-123866 can send freed response memory to a peer, and CVE-2026-123865 leaks memory and file descriptors after a session fails during shutdown.
Trust checks and credential leaks
Several flaws weaken certificate and login checks. CVE-2026-123872 lets a client change the server name during TLS 1.2 renegotiation and carry a normal login to a host that needs stricter client certificates. CVE-2026-123867 is a related per-host mutual TLS bypass, where a host configured with only a CA falls back to the default CA and the wrong client can get in. CVE-2026-123877 affects https.Agent, where a cached TLS session from a broad trust policy can be reused by a request with a stricter policy, making the second request report authorized === true when it should not.
CVE-2026-126051 lets a remote client crash TLS servers that use hooks such as SNICallback or addContext(). CVE-2026-123871 prints proxy credentials inside ERR_PROXY_INVALID_CONFIG errors, which can place secrets into logs and crash reports. That repeats the lesson from CVE-2026-48615.
Memory pressure and process exits
Two medium-severity flaws are tied to resource handling. CVE-2026-123868 lets a client send tiny one-byte frames and make the server keep about 114 bytes for every 10 bytes sent, so one stream can hold hundreds of megabytes. CVE-2026-123828 is a one-byte heap overflow in session.altsvc() that aborts the process when an app passes a long:authority value to it.
The low-severity issues involve the Permission Model and zlib. CVE-2026-123829 leaks file names on macOS and Windows through recursive fs.watch when the Permission Model denies them. CVE-2026-106071 lets a wildcard grant match more paths than intended. CVE-2026-123862 can crash an app that calls deflate.params() while streaming, although that use is rare.
Reporter credits and rollout guidance
Researcher Chris Rohlf, working with Claude and Anthropic Research, reported five of the 16 flaws. Other reporters include Pimterry, Trail of Bits, and several independent researchers. Matteo Collina fixed most of them.
The release followed a short warning, and the earlier notice did not include CVE details. The full list is now public. October’s Node2Shell Brotli bug and July’s 11 fixes show that Node.js ships serious fixes almost every month. Upgrade to v22.23.5, v24.22.3 or v26.13.1 first, with public HTTP/2 and HTTPS servers going first. Container images should be rebuilt so they carry the new runtime, and teams that served traffic from a vulnerable HTTPS handler should consider replacing their TLS keys because leaked memory leaves no clear trace. End-of-life versions are always affected, so move off them. The Node.js release schedule lists support dates.
Licensed under CC BY-ND 4.0 International