Node.js has issued security updates across its 22.x, 24.x, and 26.x branches, addressing 16 vulnerabilities—seven high-severity, six medium, and three low. The fixes come in updated builds: v22.23.5, v24.22.3, and v26.13.1. Alongside these, updates were made to bundled dependencies including llhttp, undici, and sqlite.
Memory Leakage Could Expose TLS Private Keys
A critical flaw, CVE-2026-123864, enables clients—without needing to log in—to read memory from other connections, potentially revealing TLS private keys and other users’ data. The issue stems from a re-entrancy bug: a zero-length TLS write lets Node.js decrypt another record while the HTTP parser is still working on the body, leading to a use-after-free and an out-of-bounds read that exposes old heap memory in the request body. The vulnerability manifests when a server handler invokes res.flushHeadersearly and then sends a non-empty chunk later. Only servers handling request bodies in ways that echo or store them are at risk; basic node:httpusage is unaffected.
Wider HTTP/2 Weaknesses and TLS Handshake Issues
The majority of the flaws lie in HTTP/2 code, including CVE-2026-123863, which permits remote clients to abort default HTTP/2 servers—echoing a similar issue missed in earlier fixes. Two related flaws—CVE-2026-123874 and CVE-2026-123875—arise in cases when files are sent via respondWithFile: one corrupts memory when streams are reset during a pending write, the other crashes servers when downloads are canceled.
Additional high-impact bugs include CVE-2026-123866, which may send freed response memory to requestors; and CVE-2026-123865, causing permanent leaks of memory and file handles when sessions fail during shutdown. Another serious flaw, CVE-2026-126051, allows remote clients to crash TLS servers through misuse of hooks like SNICallbackor addContext. Meanwhile, CVE-2026-123872 lets a client renegotiate TLS 1.2 to switch server names and bypass client certificate checks, and CVE-2026-123877 enables improper reuse of TLS sessions across differing trust policies.
Medium & Low Severity Risks: Memory, Permission, and Stability
Medium-level bugs include a heap overflow in session.altsvcwhen handling long authority values (CVE-2026-123828), memory exhaustion through undrained HTTP/2 streams (CVE-2026-123868), and exposure of proxy credentials in certain error messages (CVE-2026-123871). On Linux systems, a wildcard file permission issue (CVE-2026-106071) grants broader access than intended. Low-severity flaws involve file name leaks (CVE-2026-123829), uncatchable crashes during specific zlib calls (CVE-2026-123862), and over-permissive wildcard matching in the Permission Model across supported versions.
These vulnerabilities were discovered by multiple researchers, including those collaborating with Anthropic Research, Pimterry, and Trail of Bits. The majority of the fixes were implemented by maintainers led by Matteo Collina.
What Organizations Must Do Now
Users should upgrade to Node.js versions v22.23.5, v24.22.3, or v26.13.1 immediately—especially those running public HTTP/2 or HTTPS servers. Container images should be rebuilt to incorporate the updated Node.js runtime. If your infrastructure used vulnerable HTTPS handlers, consider rotating TLS private keys as memory-based leaks are hard to trace. Systems still using end-of-life Node.js releases are fully exposed and should be migrated off those versions.
Security teams should ensure these vulnerabilities are part of incident detection playbooks, especially CVE-2026-123864 given its ability to expose TLS keys silently. Close monitoring and threat intelligence updates can help identify exploitation quickly. These patches reinforce the recurring pattern: Node.js is issuing serious fixes on a monthly cadence, underlining the accelerating pace of vulnerability discovery.
Why It Matters:Exposed TLS private keys fundamentally undermine encryption, and some of these bugs allow server crashes or unauthorized access via proper channels. Robust updates like this are critical to stopping attacks before they happen.
