Node.js Fixes 16 Flaws in HTTP/2 and TLS: Remote Crashes, Heap Leaks and an mTLS Bypass — Update to 22.23.5, 24.22.3 or 26.13.1

DevSecOps · 2026-11-12 · By H.A

The 11 November Node.js security releases fix 16 vulnerabilities, seven rated High, including unauthenticated HTTP/2 crashes and heap-disclosure bugs such as CVE-2026-123864.

The Node.js project shipped coordinated security releases on 11 November 2026. They fix 16 vulnerabilities across all three supported release lines, seven of them rated High. Most of the bugs sit in the HTTP/2 and TLS code that nearly every Node.js web server depends on. They range from remote crashes that need no authentication to use-after-free bugs that can send leftover heap memory back to a client.

The fixed versions are v22.23.5, v24.22.3 and v26.13.1.

What Happened

The project pre-announced the release several days ahead, as it usually does, and published the details on Wednesday. Unusually, five of the 16 issues are credited to Chris Rohlf, working "with Claude and Anthropic Research". This is another sign that AI-assisted vulnerability research is now producing a meaningful share of findings in core open-source infrastructure. Other reporters include Node.js contributor pimterry, Trail of Bits and a range of independent researchers. Most fixes were written by Matteo Collina, with others by Rafael Gonzaga, James Snell and pimterry.

Technical Details

The High-severity issues are:

• CVE-2026-123863 – An unauthenticated client can abort the process by hitting an internal CHECK_EQ assertion in the HTTP/2 session destructor, over TLS or cleartext. It is a variant of the older CVE-2024-27983. Affects 24.x and 26.x.
• CVE-2026-123864 – A zero-length TLS write in HTTPS servers can re-enter the llhttp parser and cause a use-after-free. The result is heap memory disclosed inside response bodies. Plain node:http over cleartext is not affected. Affects 22.x, 24.x and 26.x.
• CVE-2026-123865 – HTTP/2 sessions that hit a protocol error during shutdown are never cleaned up, leaking memory and file descriptors permanently. It is an incomplete fix for CVE-2026-48937. All lines.
• CVE-2026-123866 – Tearing down an HTTP/2 stream during a backpressured write can send freed or unrelated heap memory to the peer. All lines.
• CVE-2026-126051 – Deferred TLS server handshake callbacks can operate on a destroyed socket, throwing an uncaught exception that terminates the process. Affects 24.x and 26.x.
• CVE-2026-123872 – With TLS 1.2 renegotiation, a client can change the server name and carry existing client-certificate authentication over to a stricter virtual host. All lines.
• CVE-2026-123874 – A use-after-free of an Http2Stream when a respondWithFile() stream is reset during a pending write. Affects 24.x and 26.x.

Several Medium-severity bugs matter for anyone relying on mutual TLS or outbound HTTPS:

• CVE-2026-123867 – SNI contexts that set only a CA fall back to the default client CA. That bypasses per-host mTLS authorisation.
• CVE-2026-123877 – https.Agent can reuse a TLS session between requests with and without a custom ca, skipping certificate validation.
• CVE-2026-123871 – Proxy credentials leak in ERR_PROXY_INVALID_CONFIG error messages. This is an incomplete fix for CVE-2026-48615.

The other Medium bugs are a one-byte heap overflow in session.altsvc() (CVE-2026-123828), HTTP/2 memory accounting that ignores data queued on undrained streams (CVE-2026-123868), and a NULL dereference crash when a respondWithFile() download is cancelled (CVE-2026-123875).

Three Low-severity issues touch the experimental Permission Model and zlib:

• CVE-2026-123829: recursive fs.watch leaks denied path names on macOS and Windows.
• CVE-2026-106071: wildcard --allow-fs-read rules over-grant shorter paths.
• CVE-2026-123862: a zlib params() and destroy() race throws an uncatchable assertion.

The releases also update bundled llhttp (all lines), undici (24.x and 26.x) and SQLite (22.x and 24.x).

Who Is Affected

Any application running Node.js 22, 24 or 26 that terminates HTTP/2 or TLS itself is exposed to at least some of these issues. That includes API servers, gRPC services, Next.js and other SSR front ends, and internal microservices. The project notes that end-of-life release lines are always considered affected and will not receive fixes.

Applications that sit behind a reverse proxy which terminates TLS and HTTP/2 (for example nginx, Envoy or a cloud load balancer) are less exposed to the server-side bugs. The client-side TLS validation issues, such as CVE-2026-123877, still apply.

Patch Status

Patched builds are available from the official download site, the Docker images and the usual package channels. The project did not report any exploitation in the wild.

What To Do Now

Check what you are running, then update:

node -v
# Upgrade with your version manager, e.g.
nvm install 24.22.3 && nvm alias default 24.22.3
# or pull the refreshed official image
docker pull node:24

• Rebuild and redeploy container images. A base image tag that hasn't been pulled again since 11 November is still vulnerable.
• Prioritise internet-facing HTTP/2 and HTTPS servers, especially those using respondWithFile(), mTLS with SNI, or TLS 1.2 client certificates.
• If you can't patch immediately, consider terminating HTTP/2 and TLS at a patched reverse proxy, and disabling TLS 1.2 renegotiation where it isn't needed.
• Move anything still on an end-of-life line (Node.js 20 and older) to a supported release.

Why It Matters

Node.js powers a huge share of web back ends, and HTTP/2 and TLS are exactly the layers an unauthenticated attacker touches first. Remote crashes mean easy denial of service. The heap-disclosure bugs echo earlier memory-leak classics, where fragments of other users' requests, tokens or keys end up in someone else's response.

The batch also shows that several recent fixes were incomplete. Two issues are explicitly follow-ups to earlier CVEs. And AI-assisted auditing is rapidly increasing the number of subtle lifecycle bugs found in mature native code. Teams should expect larger, more frequent runtime security releases and plan rebuild pipelines accordingly.