Node.js release closes 16 security holes across three supported lines
The Node.js project has released fixes for 16 security flaws across its 22.x, 24.x and 26.x lines. Seven are rated high, six medium, and three low. The patched builds are v22.23.5, v24.22.3 and v26.13.1, and the update also refreshes three bundled parts: llhttp, undici and sqlite. Remote memory exposure and server crashes The most serious issue is CVE-2026-123864, which affects the HTTPS code in all three lines. A client with…