The Node.js project published security releases on November 11 for its 22.x, 24.x and 26.x lines, fixing a batch of vulnerabilities that includes an HTTP/2 crash bug and memory leaks affecting HTTPS servers. The fixed versions are 22.23.5, 24.22.3 and 26.13.1, and seven of the flaws are rated high.
Conflicting Counts of Fixed Vulnerabilities
Reports differ on the size of the batch. The Hacker News counts 16 vulnerabilities, while Securityonline counts 17. The cause of the discrepancy is not explained in either report. Both agree that seven flaws carry a high severity rating.
No attacks, public exploits or CISA Known Exploited Vulnerabilities listings have been reported. Node.js offers no workaround, so updating is the only fix.
HTTP/2 Flaws Affect Crashes and Memory Exposure
Two of the headline bugs sit in the HTTP/2 implementation, and each carries a different consequence.
CVE-2026-123863: Unauthenticated Crash of Default HTTP/2 Servers
CVE-2026-123863 lets unauthenticated clients crash default HTTP/2 servers that respond before the request body arrives. It affects the 24.x and 26.x lines and works over both TLS and cleartext connections.
CVE-2026-123866: Server Memory Sent to Clients
CVE-2026-123866 is an HTTP/2 flaw that can send a client pieces of server memory. The leaked data can include responses meant for other connections. The flaw affects all release lines covered by the update.
HTTPS and TLS Flaws Expose Keys and Client Certificate Policy
Two further flaws involve the HTTPS and TLS layers, where the potential data exposure is more sensitive.
CVE-2026-123864: Private Keys and Other Users’ Requests
CVE-2026-123864 lets HTTPS servers leak memory from other connections, including TLS private keys and other users’ requests. The condition arises when a request handler calls res.flushHeaders() before the body arrives and later calls res.end() with data. Servers that use plain node:http are unaffected.
CVE-2026-123872: Servername Change During Renegotiation
CVE-2026-123872 lets a client change the servername during TLS 1.2 renegotiation to bypass client-certificate policy. A server that applies different certificate requirements per servername could therefore accept a client it was configured to reject.
Exposure Depends on Where TLS and HTTP/2 Terminate
The impact reaches servers that terminate HTTP/2, HTTPS or TLS in Node.js itself. According to The Hacker News and Securityonline, those deployments are exposed to crashes and data leakage. Services that place a separate proxy or load balancer in front of Node.js for TLS termination fall outside the scenarios described for the TLS-related flaws, though the sources do not discuss that arrangement in detail.
Leaked TLS private keys would let an attacker decrypt or impersonate traffic, so the memory-disclosure flaws weigh more heavily than the crash bug despite sharing a patch release. The fix requires upgrading to the matching version on each line, then restarting services. The projects behind the report have not linked any of the CVEs to real-world abuse, and the scale of the batch, covering three active release lines at once, means affected organizations may run several vulnerable versions in parallel.
Release Lines and Reporting Behind the Node.js Update
The three fixed versions correspond to the three lines named in the update. Version 22.23.5 covers the 22.x line, 24.22.3 covers 24.x and 26.13.1 covers 26.x. CVE-2026-123863 applies to the 24.x and 26.x lines, while CVE-2026-123866 applies to all of them. The Hacker News and Securityonline published their accounts after the project’s November 11 announcement.
The two outlets agree on the lack of workarounds, the absence of public exploits and the seven high-severity ratings, and they differ only on the total count of 16 versus 17 flaws. Neither report lists every CVE in the batch, so the four identifiers described here are the ones the sources detail.
Because HTTP/2 crash bugs and memory disclosure bugs sit in the protocol handling code that Node.js runs by default, the set of affected deployments is wide. The sources specifically name servers that terminate HTTP/2, HTTPS or TLS in Node.js itself as the exposed group.
