Affected product(s):
| Product | Affected versions |
| Node.js 26.x | Earlier than 26.13.1 (all 16 CVEs in this batch). |
| Node.js 24.x | Earlier than 24.22.3 (all 16 CVEs in this batch). |
| Node.js 22.x | Earlier than 22.23.5. According to the official advisory, it is not affected by 123863, 126051, 123874, 123828 or 123868. |
The vendor states that end-of-life versions remain affected. It did not publish CVSS scores.
Description
The Node.js security updates 26.13.1, 24.22.3 and 22.23.5 have been published, released on Nov 11, 2026. They fix sixteen vulnerabilities: seven rated high, six medium and three low, according to the vendor. The vendor did not publish CVSS scores. The highest severity fixed on all three active lines is high. End-of-life versions remain affected.
| CVE | Severity | Lines | What it is |
| CVE-2026-123863 | High | 24.x, 26.x | Remote abort via an assertion when an HTTP/2 session is torn down |
| CVE-2026-123864 | High | 22.x, 24.x, 26.x | HTTPS parser re-entrancy; may leak memory, including TLS keys |
| CVE-2026-123865 | High | 22.x, 24.x, 26.x | HTTP/2 sessions never cleaned up; memory and file-descriptor leak |
| CVE-2026-123866 | High | 22.x, 24.x, 26.x | Use-after-free when an HTTP/2 stream is torn down; may send freed memory |
| CVE-2026-126051 | High | 24.x, 26.x | Remotely triggerable uncaught exception in TLS; terminates the process |
| CVE-2026-123872 | High | 22.x, 24.x, 26.x | TLS 1.2 renegotiation changes the servername and bypasses per-host mTLS |
| CVE-2026-123874 | High | 24.x, 26.x | Use-after-free of Http2Stream with respondWithFile() or respondWithFD() |
| CVE-2026-123828 | Medium | 24.x, 26.x | One-byte heap overflow in session.altsvc() |
| CVE-2026-123867 | Medium | 22.x, 24.x, 26.x | The CA on an SNI context fails open to the default CA (mTLS) |
| CVE-2026-123868 | Medium | 24.x, 26.x | Inbound HTTP/2 data not charged to the session; memory exhaustion |
| CVE-2026-123871 | Medium | 22.x, 24.x, 26.x | Proxy credentials in ERR_PROXY_INVALID_CONFIG errors |
| CVE-2026-123877 | Medium | 22.x, 24.x, 26.x | https.Agent reuses a TLS session across CA policies |
| CVE-2026-123875 | Medium | 22.x, 24.x, 26.x | Cancelling respondWithFile() crashes the server (NULL dereference) |
| CVE-2026-123829 | Low | 22.x, 24.x, 26.x | Recursive fs.watch leaks denied names (macOS and Windows) |
| CVE-2026-123862 | Low | 22.x, 24.x, 26.x | zlib params()+destroy() throws an uncatchable assertion |
| CVE-2026-106071 | Low | 22.x, 24.x, 26.x | Wildcard over-grant in –allow-fs-read or –allow-fs-write |
CVE-2026-123864, rated high, affects HTTPS servers on 22.x, 24.x and 26.x: a zero-length write can re-enter the parser and cause a use-after-free and an out-of-bounds read. According to the vendor, an unauthenticated remote client may be able to read memory belonging to other connections, including TLS private keys and other users’ requests. Cleartext HTTP is not affected.
Four high-severity issues affect HTTP/2. CVE-2026-123863, on 24.x and 26.x only, allows an unauthenticated remote client to abort the server by triggering an assertion when the session is destroyed, over both TLS and cleartext; the vendor describes it as a variant of an earlier incomplete fix. CVE-2026-123865, on 22.x, 24.x and 26.x, leaves sessions unclean after a protocol error during shutdown, with a permanent leak of memory and file descriptors; it is an incomplete fix of CVE-2026-48937. CVE-2026-123866, on all three lines, is a use-after-free during stream teardown that can send already freed memory to the peer, including other connections’ responses. CVE-2026-123874, on 24.x and 26.x only, is a use-after-free of Http2Stream when respondWithFile() or respondWithFD() is used and the stream is reset during a pending write.
In TLS, CVE-2026-126051, rated high and limited to 24.x and 26.x, allows an unauthenticated remote attacker to trigger an uncaught exception that terminates the process, through deferred handshake callbacks, when the server uses SNICallback, OCSPRequest, newSession, resumeSession or addContext. CVE-2026-123872, on 22.x, 24.x and 26.x, allows a client, during a TLS 1.2 renegotiation, to change the servername and carry its authentication to a host with a stricter client-certificate policy.
Among the medium-severity issues, CVE-2026-123828 (24.x and 26.x only) is a one-byte heap overflow in session.altsvc() when a long origin is passed. CVE-2026-123868 (24.x and 26.x only) does not charge inbound HTTP/2 data retained on an undrained stream against maxSessionMemory, which can exhaust memory. CVE-2026-123867, on all three lines, causes an SNI context that only defines a CA to fail open to the default CA and bypass per-host mTLS authorization. CVE-2026-123877 allows https.Agent to reuse a TLS session authenticated under one CA policy and apply it to a stricter one. CVE-2026-123871 discloses proxy credentials in ERR_PROXY_INVALID_CONFIG messages, on paths missed by an earlier fix (CVE-2026-48615). CVE-2026-123875 allows an unauthenticated client to crash the server (NULL dereference) by cancelling a download started with respondWithFile() or respondWithFD(), over both TLS and cleartext.
The three low-severity issues affect 22.x, 24.x and 26.x. CVE-2026-123829, in the Permission Model, allows a recursive fs.watch to disclose the names of denied files or directories on macOS and Windows, not their contents. CVE-2026-123862 causes the combination of params() and destroy() in zlib to throw an uncatchable internal assertion and terminate the process, in an uncommon use of the API. CVE-2026-106071 grants read or write access to paths that should not match a wildcard rule in –allow-fs-read or –allow-fs-write, when that rule sits at the root of the permission tree.
The vendor reports no exploitation of these vulnerabilities. No public proof of concept was identified. This batch also updates dependencies: llhttp on 22.x, 24.x and 26.x; undici on 24.x and 26.x; and sqlite on 22.x and 24.x.
Mitigation
Inventory Node.js installations, record the exact line and version, and update to the fixed release for the branch in use. Prioritize exposed servers that use HTTP/2 or HTTPS/TLS with SNICallback, OCSP or per-host mutual authentication, and plan the migration of end-of-life lines. The vendor did not publish official workarounds.
These measures do not replace the update. The patch does not undo a prior compromise.
Detection
The vendor did not publish indicators of compromise. Detection is limited to inventorying the running version and checking whether it is earlier than the fix for its line.
Solution
The solution is to update each active line to the fixed version, or later: 26.13.1 on 26.x, 24.22.3 on 24.x and 22.23.5 on 22.x. End-of-life versions do not receive these fixes; the vendor states that they remain affected and should be moved to a supported, already fixed line.
| Line | Fix |
| Node.js 26.x | 26.13.1 or later |
| Node.js 24.x | 24.22.3 or later |
| Node.js 22.x | 22.23.5 or later |
For information on how to update, visit the following link:
https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
Additional information:
- Node.js — November 2026 Security Releases:
https://nodejs.org/en/blog/vulnerability/november-2026-security-releases - Node.js — vulnerability advisory index:
https://nodejs.org/en/blog/vulnerability - Node.js — 26.13.1 release notes:
https://nodejs.org/en/blog/release/v26.13.1 - Node.js — 24.22.3 release notes:
https://nodejs.org/en/blog/release/v24.22.3 - Node.js — 22.23.5 release notes:
https://nodejs.org/en/blog/release/v22.23.5