The Node.js project has issued critical security updates to address 11 vulnerabilities across its active release lines: 22.x, 24.x, and 26.x. These updates are now available as versions v22.23.2, v24.18.1, and v26.5.1.
Among the most severe issues are two high-severity vulnerabilities affecting HTTP/2 processing. CVE-2026-56846 allows attackers to bypass the maxSessionMemory limit by sending specially crafted traffic, potentially leading to a denial-of-service (DoS) condition. CVE-2026-56848 involves a heap use-after-free flaw in the nghttp2 library, which could crash the process and may have broader security implications depending on runtime conditions.
Another high-severity vulnerability, CVE-2026-58043, pertains to the Node.js Permission Model. Applications launched with the `–permission` option could inadvertently grant filesystem access beyond the intended allowlist due to issues in radix-tree prefix boundary handling. This flaw enables users with access to an approved path to potentially read or write files in unintended locations.
Several medium-severity vulnerabilities have also been addressed. CVE-2026-56850 could result in HTTPS Agents reusing mutual TLS identities across requests with different PFX certificates. CVE-2026-58040 corrects an incomplete earlier patch that could permit TLS session reuse to bypass hostname verification across identity policies. Additionally, CVE-2026-58042 can cause `dns.resolveAny()` to abort when the response contains more than 256 A records, and CVE-2026-58045 can crash synchronous Node:zlib APIs when using a spoofed TypedArray byte length.
Other vulnerabilities include CVE-2026-56847 and CVE-2026-58039, which involve Permission Model bypasses related to trace-event logs and process reports, respectively. Both could allow writing files outside of paths authorized by `–allow-fs-write`. Lastly, CVE-2026-58044 addresses an issue with HTTP header truncation that could enable request smuggling in Node.js-based forwarding proxies.
Administrators are strongly urged to upgrade to the latest versions immediately, test production dependencies, and retire unsupported Node.js versions, as these remain vulnerable when security flaws are disclosed.
These updates underscore the importance of maintaining up-to-date software to mitigate potential security risks. As Node.js continues to be a critical component in many applications, staying vigilant and proactive in applying security patches is essential to ensure system integrity and reliability.
