Node.js has released security updates for 16 vulnerabilities, including high-severity HTTP/2 bugs that can let unauthenticated remote clients crash servers or receive memory containing data from other connections. The fixes are available in 22.23.5, 24.22.3 and 26.13.1, released November 11. The Node.js project rates the highest-impact issues High severity. [1][2]
The most direct denial-of-service threat is CVE-2026-123863, which affects Node.js 24.x and 26.x. A malformed HTTP/2 connection can leave stream state and nghttp2 header buffers alive after session removal, causing an internal assertion to terminate the process. Node.js says the attack works against typical default HTTP/2 servers whose handlers respond before the request body has ended, over both TLS and cleartext. The CVE carries a CVSS 3.x score of 8.2, with network reachability, no privileges or user interaction, and high availability impact. [2][16]
Another High-severity issue, CVE-2026-123866, affects all three supported lines. It is a use-after-free during HTTP/2 stream teardown: when output remains backpressured and a stream is reset or destroyed, Node.js can continue using a response buffer after it has been freed. The result may be disclosure of unrelated heap contents, including responses intended for other connections. NVD assigns the flaw a CVSS 3.x score of 7.5, with high confidentiality impact and no required authentication or user interaction. [2][17]
The release also addresses other remotely reachable HTTP/2 and TLS problems. These include session and file-descriptor leaks during shutdown (CVE-2026-123865), a use-after-free in HTTP/2 file responses (CVE-2026-123874), a heap-buffer overflow in session.altsvc() (CVE-2026-123828), and a memory-exhaustion condition involving undrained inbound data (CVE-2026-123868). Additional fixes cover TLS callback crashes, TLS 1.2 renegotiation and client-certificate authorization, certificate-policy handling in https.Agent, proxy credential exposure, zlib, SQLite and the Permission Model. [2]
Node.js did not report exploitation in the wild or public proof-of-concept code in its advisory, and the vulnerabilities were not identified in the CISA Known Exploited Vulnerabilities catalog in the available reporting. That does not reduce the practical risk for internet-facing services: the two central HTTP/2 flaws require no credentials, while several others depend only on specific application features such as respondWithFile(), custom TLS callbacks or HTTP/2 request handling. Operators should upgrade promptly to the patched release for their active line, review whether HTTP/2 and the affected TLS features are enabled, and avoid relying on end-of-life Node.js branches, which do not receive these fixes. [2][24][28]
References
- Node.js — Node.js 24.22.3 (LTS)
- Node.js — Wednesday, November 11, 2026 Security Releases
- CVE-2026-123863
- CVE-2026-123866
- NVD – NVD Dashboard
- cve-2026-123866.json
