Node.js releases security updates for the 22.x, 24.x, and 26.x lines

Node.js has announced security releases for its server-side JavaScript runtime, addressing multiple issues in HTTP/2, HTTPS, and TLS. See the Node.js November 2026 security release announcement to identify the release for your version line.

Overview and technical details

The record lists the issues as high and medium severity but provides no CVSS scores. Described impacts include service disruption, memory or data exposure, and certificate-authentication issues.

Affected systems

The announcement covers the 22.x, 24.x, and 26.x lines. The record confirms security updates for all three lines but does not provide specific fixed version numbers.

Relevant conditions may include a default HTTP/2 server; an application calling flushHeaders() before receiving the full request body and then ending the response with a non-empty chunk; echo or request-body storage routes; TLS hooks; different client-certificate policies by hostname; use of respondWithFile() or respondWithFD(); and passing an attacker-controlled value such as :authority to Http2Session.altsvc().

CVE-2026-123864 does not affect cleartext node:http. CVE-2026-123863, CVE-2026-126051, CVE-2026-123874, and CVE-2026-123828 are identified as affecting the 24.x and 26.x lines. For CVE-2026-123866, exploitation purely by a peer on 24.x and 26.x depends on the window-size change introduced in 24.22.0 and 26.9.0; the issue may still be reachable on all supported lines through application-initiated teardown, such as a stream idle timeout.

Mechanism and impact

The HTTP/2 issues described include an assertion that can crash a server, use-after-free and out-of-bounds reads that can expose heap data, memory and file descriptor leaks, and a one-byte heap overflow through HTTP/2 Alt-Svc. Other issues involve an uncaught exception that can stop a TLS server and bypassing client-certificate authentication in TLS 1.2.

Exploit conditions depend on application request handling, HTTP/2 and TLS configuration, and the APIs used; not every system has the same exposure conditions.

System checks

1. Check the running Node.js version to identify the line to compare with the security release.
   Copy commands

   node -v

If the version belongs to the 22.x, 24.x, or 26.x line, compare it with and upgrade to the corresponding security release. The record does not provide a specific fixed version number.

Remediation and mitigation

1. Prioritize upgrading: update Node.js to the security release for the 26.x, 24.x, or 22.x line in use.
2. Review relevant configuration: check the HTTP/2 usage, request-body handling, and TLS configurations described in the affected scope.
3. Note dependency updates: the announcement lists updates to llhttp on 22.x, 24.x, and 26.x; undici on 24.x and 26.x; and sqlite on 22.x and 24.x.