The Node.js project shipped security releases on Wednesday, November 11, for all three supported lines: 22.23.5, 24.22.3 and 26.13.1. The advisory lists 16 vulnerabilities in Node.js itself (seven high, six medium, three low, by our count of the advisory) and says the releases also update the bundled llhttp, undici and sqlite dependencies. The project reports no attacks using any of them. Most of the high-rated flaws are in the HTTP/2, HTTPS and TLS server code, so they matter where a Node.js process accepts those connections itself.
Two stand out. CVE-2026-123863 lets any unauthenticated client abort a server over TLS or cleartext HTTP/2: a stream that still holds header buffers can outlive its session, and a check at session teardown then terminates the process. It needs only a default http2 server whose handler responds before the request body has ended, which the advisory calls typical, and it affects the 24.x and 26.x lines. CVE-2026-123864 affects all three lines: in an HTTPS server, a zero-length TLS write can re-enter the HTTP parser, and an unauthenticated client can read memory belonging to other connections, “including TLS private keys and other users’ requests.” It needs a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, plus a route that echoes or stores a request body to read the leak; plain node:http is not affected. Both were reported by Chris Rohlf “in collaboration with Claude and Anthropic Research,” according to the advisory.
The other high-rated flaws are CVE-2026-123865 (an HTTP/2 client can make a server hold memory and file descriptors indefinitely, via a GOAWAY frame followed by a protocol error; all three lines), CVE-2026-123866 (freed response memory, including other connections’ response buffers, can be sent to a peer when an HTTP/2 stream is torn down mid-write; all three lines, and a remote peer alone can trigger it from 24.22.0 and 26.9.0 onward), CVE-2026-123874 (memory corruption on 24.x and 26.x when a server serves files with stream.respondWithFile() or respondWithFD()), CVE-2026-126051 (a remote client can terminate a TLS server on 24.x and 26.x that uses the SNICallback, OCSPRequest, newSession or resumeSession hooks, or server.addContext()) and CVE-2026-123872 (a client certificate authentication bypass during TLS 1.2 renegotiation on servers that apply different client-certificate rules per hostname; all three lines).
How to check if you’re affected
Affected products are Node.js servers that accept HTTP/2, HTTPS or TLS connections directly, on the 22.x, 24.x and 26.x lines. Affected versions are 22.x before 22.23.5, 24.x before 24.22.3 and 26.x before 26.13.1; run node --version on each server or container image to see which you have. The advisory says end-of-life versions are always affected when a security release occurs and gets no fix, so servers still on an unsupported line, such as 20.x or 25.x (the lines The Hacker News names), need to move to a supported one. The advisory lists no workaround for servers that cannot update yet.
Which flaws apply depends on your code: for example, CVE-2026-123864 needs the flushHeaders() pattern above and CVE-2026-123874 needs file serving through respondWithFile() or respondWithFD(). According to The Hacker News, the advisory does not say whether servers that met the conditions for the HTTPS flaw should replace their TLS keys or other secrets after updating.
For a related Node.js release last month, see Node.js Patches Brotli Flaw That Could Allow Code Execution.