Title: Node.js Ships 16 Fixes Across 22.x, 24.x and 26.x — Update to 22.23.5, 24.22.3, 26.13.1
Summary:
The Node.js project released security updates on Wednesday, November 11, 2026, for all three supported release lines — v22.23.5, v24.22.3 and v26.13.1 — closing 16 vulnerabilities, seven of them rated high. The headline crash bug, CVE-2026-123863 (high), is a reachable assertion in HTTP/2 session teardown (CHECK_EQ(current_nghttp2_memory_, 0) in ~Http2Session()) that lets any unauthenticated client abort the server over both TLS and cleartext. The advisory frames the precondition as ordinary: an http2 server at default settings whose handler starts responding while the client is still uploading the request body. It affects 24.x and 26.x and is a variant of CVE-2024-27983 that the earlier fix missed because it only detached streams still tracked in the session. Equally concerning, CVE-2026-123864 (high, all three lines) is a re-entrancy flaw in HTTPS where a zero-length TLS write issued from JavaScript inside the parser’s on_body callback re-enters llhttp_execute(), producing a use-after-free and out-of-bounds heap read that makes the server copy heap memory — including TLS private keys and other users’ requests — into a response. Setting it off takes a handler that flushes headers while the incoming body is still streaming and then writes data in a later res.end(), with the application echoing or persisting that body; servers built on plain node:http are unaffected. CVE-2026-123866 (high, all lines) is a use-after-free in HTTP/2 stream teardown that sends freed response memory — including other connections’ response buffers — to the peer; from 24.22.0 and 26.9.0 onward a client alone can trigger it, and on older builds it is reachable through application-initiated teardown such as a per-stream idle timeout. The remaining high-rated flaws: CVE-2026-123865, a protocol error during connection shutdown leaves sessions in CLOSE_WAIT leaking memory and file descriptors indefinitely (all lines); CVE-2026-126051, a remotely triggerable uncaught exception crashing TLS servers that use SNICallback, OCSPRequest, newSession, resumeSession or server.addContext() (24.x, 26.x); CVE-2026-123872, a client-cert authentication bypass in which a client changes its servername during TLS 1.2 renegotiation to carry a weaker host’s authentication into a stricter one (all lines); and CVE-2026-123874, a use-after-free corrupting memory when servers serve files with stream.respondWithFile()/respondWithFD() and the client resets the stream (24.x, 26.x). Mediums include a one-byte heap overflow in session.altsvc(), CA-only SNI overrides failing open to the default CA, an https.Agent certificate-validation bypass via cross-policy TLS session reuse, and proxy credentials leaking into ERR_PROXY_INVALID_CONFIG errors. The advisory lists no workaround for servers that cannot update: moving to the fixed line versions is the only fix, and end-of-life lines such as 20.x and 25.x receive nothing and are always affected. The advisory credits Chris Rohlf, working with Claude and Anthropic Research, for reporting five of the sixteen issues — among them the HTTP/2 crash and the HTTPS memory-disclosure bugs. The advisory reports no known attacks.
References: