Node.js patches 16 flaws that can leak TLS keys or crash servers
Original title: Node.js Fixes 16 Security Vulnerabilities That Could Expose TLS Private Keys and Crash Servers Remotely
Fixed builds are v22.23.5, v24.22.3 and v26.13.1; seven flaws are high, and exploitation is not mentioned.
The Node.js project fixed 16 security flaws in the 22.x, 24.x and 26.x lines: seven high, six medium and three low. CVE-2026-123864 can copy heap memory, including TLS private keys, into a request body when a handler flushes headers early. Most issues are in HTTP/2 and can abort servers, exhaust memory, bypass client-certificate checks, or return freed response data. Public HTTP/2 and HTTPS servers should be upgraded first, then container images rebuilt.
Unconfirmed: The advisory does not say whether any of the 16 flaws are exploited.
- CVE-2026-123864 affects HTTPS on 22.x, 24.x and 26.x; plain node:http is not affected.
- CVE-2026-123863 is a missed variant of CVE-2024-27983 that aborts default HTTP/2 servers.
- Chris Rohlf, with Claude and Anthropic Research, reported five of the 16 flaws.
- Matteo Collina fixed most issues; the release also refreshes llhttp, undici and sqlite.
Impact: TLS private-key and request-data leaks, remote crashes, or mTLS bypass
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | 22.x, 24.x and 26.x | v22.23.5, v24.22.3 and v26.13.1 |
- 1.Upgrade Node.js to v22.23.5, v24.22.3, or v26.13.1.
- 2.Patch public HTTP/2 and HTTPS servers before other deployments.
- 3.Rebuild container images so they include the new runtime.
- CVEs
- CVE-2026-123863CVE-2026-123864CVE-2026-123865CVE-2026-123866CVE-2026-126051CVE-2026-123872CVE-2026-123874CVE-2026-123828CVE-2026-123867CVE-2026-123868CVE-2026-123871CVE-2026-123877CVE-2026-123875CVE-2026-123829CVE-2026-123862CVE-2026-106071
- Vendors
- Node.js
- Organizations
- AnthropicTrail of Bits
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-106071 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule | 3.6 | — | ||
| CVE-2026-123863 | Unauthenticated HTTP/2 assertion crash in Node.js | 8.2 group max | — |
From the original article
4 min read at cybersecuritynews.com
The Node. js project has released fixes for 16 security flaws across its 22. x, 24.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.