Node.js patches 16 flaws, including crashes and TLS key leaks
Original title: Node.js Patches 16 Security Vulnerabilities Allowing Remote Server Crashes, Memory Leaks, and Authentication Bypass
Fixed builds are v22.23.5, v24.22.3 and v26.13.1; seven issues are high and many are remotely triggerable.
The Node.js project released November 11, 2026 updates for the 22.x, 24.x and 26.x lines covering 16 vulnerabilities: seven high, six medium and three low. High-severity issues include an HTTP/2 assertion crash, HTTPS memory disclosure that can include TLS private keys, use-after-free, and client-certificate authentication bypasses. The release also updates llhttp, undici and sqlite. End-of-life releases remain affected, and these specific flaws are not described as exploited.
Unconfirmed: The cited active exploitation concerns a prior Brotli flaw, not these 16 issues.
- CVE-2026-123863 can abort default HTTP/2 servers on 24.x and 26.x.
- CVE-2026-123864 can leak other connections’ memory, including TLS private keys.
- CVE-2026-123872 carries authentication across hosts during TLS 1.2 renegotiation.
- CVE-2026-123871 exposes proxy credentials in ERR_PROXY_INVALID_CONFIG messages.
- Chris Rohlf, with Claude and Anthropic Research, reported several of the flaws.
Impact: remote crashes, TLS key disclosure, and authentication bypass
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | 22.x, 24.x, and 26.x | v22.23.5, v24.22.3, and v26.13.1 |
- 1.Upgrade to v22.23.5, v24.22.3 or v26.13.1 and restart services.
- 2.Limit public exposure of HTTP/2 and file-serving endpoints until patched.
- 3.Avoid reflecting :authority values into altsvc().
- CVEs
- CVE-2026-123863CVE-2026-123864CVE-2026-123866CVE-2026-123865CVE-2026-126051CVE-2026-123874CVE-2026-123872CVE-2026-123867CVE-2026-123877CVE-2026-123828CVE-2026-123868CVE-2026-123875CVE-2026-123871
- Vendors
- Node.js
- Organizations
- Anthropic ResearchTrail of BitsCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123863 | Unauthenticated HTTP/2 assertion crash in Node.js | 8.2 group max | — |
From the original article
2 min read at gbhackers.com
The Node. js Project released security updates on November 11, 2026, for the 26. x, 24.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.