The Node.js project has released fixes for 16 security flaws across its 22.x, 24.x and 26.x lines. Seven are rated high, six medium, and three low. The official advisory says the patched builds are v22.23.5, v24.22.3 and v26.13.1. The update also refreshes three bundled parts: llhttp, undici, and sqlite.
Memory Leak Could Expose TLS Private Keys
The high-severity flaw is CVE-2026-123864. It affects the HTTPS code in all three lines. A client with no login can read memory that belongs to other connections. That memory can hold TLS private keys and other users’ requests.
The cause is a re-entry problem. A zero-length TLS write can make Node.js decrypt the next record while the HTTP parser is still reading a body. This causes a use-after-free and an out-of-bounds read, so the server copies old heap memory into the request body.
A server is at risk only if a handler calls res.flushHeaders() early and later ends with a non-empty chunk. A route that echoes or stores request bodies lets the attacker read the leak. Plain node:http is not affected, according to the Node.js security notes.
HTTP/2 code accounts for most of the list. CVE-2026-123863 lets any client abort a default HTTP/2 server. It is a variant of CVE-2024-27983 that the older fix missed. CVE-2026-123874 and CVE-2026-123875 hit servers that send files with respondWithFile(). One corrupts memory. The other crashes the server when a download is canceled, and a handful of canceled requests is enough.
CVE-2026-123866 can send freed response memory to a peer, which may include other users’ response data. CVE-2026-123865 leaks memory and file descriptors forever once a session fails during shutdown. It repairs a gap left by CVE-2026-48937, which we covered in our June Node.js patch report.
Two medium flaws also matter. CVE-2026-123868 lets a client send tiny one-byte frames and make the server keep about 114 bytes for every 10 bytes sent. One stream can then hold hundreds of megabytes. CVE-2026-123828 is a one-byte heap overflow in session.altsvc() that aborts the process when an app passes a long :authority value to it.
| # | CVE | Severity | Affected Lines | Issue |
|---|---|---|---|---|
| 1 | CVE-2026-123863 | High | 24.x, 26.x | HTTP/2 session teardown assertion lets a remote client abort the server |
| 2 | CVE-2026-123864 | High | 22.x, 24.x, 26.x | HTTPS zero-length TLS write re-enters llhttp and leaks heap memory, including TLS private keys |
| 3 | CVE-2026-123865 | High | 22.x, 24.x, 26.x | HTTP/2 sessions never clean up after a protocol error during shutdown, leaking memory and file descriptors |
| 4 | CVE-2026-123866 | High | 22.x, 24.x, 26.x | HTTP/2 stream teardown use-after-free sends freed response memory to the peer |
| 5 | CVE-2026-126051 | High | 24.x, 26.x | Deferred TLS handshake callbacks cause a remote uncaught exception that kills the server |
| 6 | CVE-2026-123872 | High | 22.x, 24.x, 26.x | TLS 1.2 renegotiation lets a client change servername and bypass client certificate checks |
| 7 | CVE-2026-123874 | High | 24.x, 26.x | HTTP/2 use-after-free in respondWithFile() streams reset during a pending write |
| 8 | CVE-2026-123828 | Medium | 24.x, 26.x | One-byte heap overflow in session.altsvc() with a long origin |
| 9 | CVE-2026-123867 | Medium | 22.x, 24.x, 26.x | CA-only SNI client-CA override falls back to the default CA, bypassing per-host mTLS |
| 10 | CVE-2026-123868 | Medium | 24.x, 26.x | HTTP/2 inbound data on an undrained stream escapes maxSessionMemory, allowing memory exhaustion |
| 11 | CVE-2026-123871 | Medium | 22.x, 24.x, 26.x | Proxy credentials exposed in ERR_PROXY_INVALID_CONFIG error messages |
| 12 | CVE-2026-123877 | Medium | 22.x, 24.x, 26.x | https.Agent reuses a TLS session across different CA policies, bypassing certificate validation |
| 13 | CVE-2026-123875 | Medium | 22.x, 24.x, 26.x | Cancelling a respondWithFile() download causes a NULL dereference and crashes the server |
| 14 | CVE-2026-123829 | Low | 22.x, 24.x, 26.x | Recursive fs.watch leaks names of files the Permission Model denies (macOS and Windows) |
| 15 | CVE-2026-123862 | Low | 22.x, 24.x, 26.x | A pending zlib params() plus destroy() throws an uncatchable assertion and ends the process |
| 16 | CVE-2026-106071 | Low | 22.x, 24.x, 26.x | Permission Model wildcard lookup over-grants file system access |
Login and Certificate Checks Failure
Several bugs weaken trust checks. CVE-2026-123872 lets a client switch the server name during TLS 1.2 renegotiation. It can carry a normal login to a host that needs stricter client certificates. CVE-2026-123867 is a related per-host mutual TLS bypass. A host configured with only a CA falls back to the default CA, so the wrong client can get in.
CVE-2026-123877 affects https.Agent. A cached TLS session from a broad trust policy can be reused by a request with a stricter policy. The second request then reports authorized === true when it should not.
CVE-2026-126051 lets a remote client crash TLS servers that use hooks such as SNICallback or addContext(). CVE-2026-123871 prints proxy credentials inside ERR_PROXY_INVALID_CONFIG errors. That puts secrets into logs and crash reports. It repeats the lesson from CVE-2026-48615.
The three low flaws touch the Permission Model and zlib. CVE-2026-123829 leaks file names on macOS and Windows. CVE-2026-106071 lets a wildcard grant match more paths than intended. CVE-2026-123862 can crash an app that calls deflate.params() while streaming, though that use is rare.
Researcher Chris Rohlf, working with Claude and Anthropic Research, reported five of the 16 flaws. Other reporters include Pimterry, Trail of Bits, and several independent researchers. Matteo Collina fixed most of them.
This release followed a short warning. Our earlier story on the scheduled patch noted that the notice gave no CVE details. The full list is now public. October’s Node2Shell Brotli bug and July’s 11 fixes show that Node.js ships serious fixes almost every month.
Upgrade to v22.23.5, v24.22.3, or v26.13.1 first. Public HTTP/2 and HTTPS servers should go first. Then rebuild container images so they carry the new runtime. Teams that served traffic from a vulnerable HTTPS handler should consider replacing their TLS keys, since leaked memory leaves no clear trace. End-of-life versions are always affected, so move off them. The Node.js release schedule lists support dates.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
