Node.js releases fixes for HTTP/2 and HTTPS memory flaws
The Node.js project has released versions 22.23.5, 24.22.3 and 26.13.1 to fix 16 vulnerabilities, including flaws that let unauthenticated clients crash HTTP/2 servers or read memory from other connections. The release applies to operators running Node.js 22.x, 24.x or 26.x, and was published on November 12, 2026.
CVE-2026-123863 affects a default HTTP/2 server that sends a response before the request body has fully arrived. The Node.js project says a client can trigger the crash over both TLS and cleartext connections. CVE-2026-123866 can make a server send pieces of its memory to a client, including responses intended for other connections. On newer 24.x and 26.x builds, a client alone can trigger that flaw.
CVE-2026-123864 affects Node.js HTTPS servers whose handlers call res.flushHeaders() before the request body has arrived and later call res.end() with data. According to the project, an unauthenticated client may read memory from other connections, including TLS private keys and other users' requests. The attack also requires a route that sends back or stores a request body. Plain HTTP servers built with node:http are not affected.
The release also fixes flaws that can permanently consume memory and file descriptors, corrupt server memory while serving files, crash TLS servers, or bypass stricter client-certificate rules during TLS 1.2 renegotiation. The Node.js advisory says these issues affect servers using the relevant HTTP/2, file-serving or TLS features across the supported release lines.
The Node.js project lists an update to the fixed version for each release line as the only fix and gives no workaround for servers that cannot update. End-of-life lines, including 20.x and 25.x, received no fix and remain affected. The advisory does not report attacks using these vulnerabilities, and it does not say whether operators should replace TLS keys or other secrets after patching.