Node.js fixes 16 flaws, including HTTP/2 crash and memory leaks
Original title: Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
Fixed builds are 22.23.5, 24.22.3 and 26.13.1; the project reports no attacks and lists no workaround.
Node.js patched 16 vulnerabilities in its own code, seven rated high, across supported lines 22, 24 and 26. Unauthenticated clients can crash default HTTP/2 servers on 24.x and 26.x, and separate HTTP/2 and HTTPS flaws can leak memory from other connections, including TLS private keys. Updating to 22.23.5, 24.22.3 or 26.13.1 is the only fix named; end-of-life lines including 20.x and 25.x are not fixed. The advisory reports no attacks.
Unconfirmed: The advisory does not say whether servers that met the HTTPS leak conditions should replace TLS keys.
- CVE-2026-123863 crashes default HTTP/2 servers on 24.x and 26.x over TLS or cleartext.
- CVE-2026-123864 can expose TLS private keys when flushHeaders() runs before the body arrives.
- CVE-2026-123866 is client-triggerable from 24.22.0 and 26.9.0; older builds need a mid-response close.
- Five flaws, including the crash and HTTPS leak, were reported with Anthropic Research.
Impact: Unauthenticated crash or leak of other connections' memory, including TLS keys
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | Supported 22.x, 24.x and 26.x; EOL 20.x and 25.x unfixed and described as always affected | 22.23.5, 24.22.3, 26.13.1 |
- 1.Update each supported line to 22.23.5, 24.22.3 or 26.13.1; the advisory lists no workaround.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123863 | Unauthenticated HTTP/2 assertion crash in Node.js | 8.2 group max | — |
From the original article
2 min read at thehackernews.com
A flaw fixed in Node. js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24. x and 26.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.