top of page
Search

Node.js Fixed 16 Flaws, Two That Hand Other Users' Memory to a Stranger. If Node Terminates HTTP/2 or HTTPS Itself, Upgrade to 22.23.5, 24.22.3 or 26.13.1 First.

Writer: Patrick Duggan
Patrick Duggan
41 minutes ago
6 min read

Upgrade Node.js to 22.23.5, 24.22.3 or 26.13.1 and rebuild your container images, starting with any Node process that accepts HTTP/2 or HTTPS connections directly from the internet, with no reverse proxy terminating the connection in front of it. The November 11 security release fixes 16 flaws, seven of them rated high by the Node.js project. Two of the high ones can send one user's memory to another: CVE-2026-123864 in HTTPS servers and CVE-2026-123866 in HTTP/2 servers. If you are on Node 20, 23 or 25, there is no fix for you, and moving to a supported line is the patch.


This is the second Node security release in three weeks. The first fixed the Brotli decoder bug we wrote about on October 22: Node.js Fixed a Brotli Bug That Can Lead to Code Execution. If you upgraded then, you need to upgrade again.



What Node says


We read the advisory on nodejs.org directly. It states: "The highest severity issue fixed in this release is HIGH." The download index on nodejs.org dates 24.22.3 and 26.13.1 to November 10 (a Tuesday) and 22.23.5 to November 11 (a Wednesday). Node gives no CVSS scores and lists no workarounds.


The seven high-severity flaws, in Node's words:


  • CVE-2026-123864, HTTPS, all three lines (22, 24, 26). "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests." It has preconditions: "Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body." And: "Cleartext node:http is not affected." This one needs only the https module, not http2.

  • CVE-2026-123866, HTTP/2, all three lines. "A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer." On 24.x and 26.x, "the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present". On every supported line it is also reachable "through an application-initiated teardown such as a per-stream idle timeout." Read that against last month: the Brotli fix versions, 24.22.1 and 26.12.1, are inside the range where a remote peer alone can drive this.

  • CVE-2026-123863, HTTP/2, 24 and 26. "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext." Node says the trigger "needs only a default http2 server whose handler responds before the request body has ended, which is typical." It is a variant of CVE-2024-27983 that the earlier fix missed.

  • CVE-2026-123865, HTTP/2, all three lines. "An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors."

  • CVE-2026-123874, HTTP/2, 24 and 26. "A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD()." Node calls that the only precondition.

  • CVE-2026-126051, TLS, 24 and 26. A remote, unauthenticated attacker can "terminate the server process" when a TLS server uses the SNICallback, OCSPRequest, newSession or resumeSession hooks, or server.addContext().

  • CVE-2026-123872, TLS, all three lines. "A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for."

The other nine are rated medium (six) or low (three). The medium ones are worth a look if they describe you: three more HTTP/2 flaws (a one-byte heap overflow in session.altsvc(), CVE-2026-123828; memory exhaustion through undrained streams, CVE-2026-123868; and a crash when a client cancels a respondWithFile() download, CVE-2026-123875), a per-host mutual-TLS bypass through SNI and server.addContext() (CVE-2026-123867), and a certificate validation bypass in https.Agent through TLS session reuse (CVE-2026-123877), which is a client-side flaw. Proxy credentials can also leak into ERR_PROXY_INVALID_CONFIG error messages (CVE-2026-123871).


Node credits five of the 16, including CVE-2026-123863, CVE-2026-123864 and CVE-2026-123874, to "Chris Rohlf in collaboration with Claude and Anthropic Research". Matteo Collina wrote most of the fixes.



What is not known


  • Exploitation. Neither Node nor The Hacker News reports attacks. None of the 16 is in CISA's Known Exploited Vulnerabilities catalog as of version 2026.11.10. We found no public proof-of-concept for CVE-2026-123863, 123864 or 123866 in the exploit repositories we collect.

  • Whether to rotate keys. CVE-2026-123864 can leak TLS private keys. The advisory does not say whether a server that met its conditions should rotate its certificate keys or other secrets, a gap The Hacker News also points out. Our reading: if a public HTTPS server of yours calls res.flushHeaders() before reading the body and has any route that echoes or stores a request body, treat its TLS key as possibly exposed, and rotate it after you patch. That is a judgement, not something Node says.


Who must patch first


Our reading of the advisory, in order:


  1. Node processes that terminate HTTP/2 themselves, meaning servers built with http2.createServer or http2.createSecureServer that the internet reaches directly. Several of the HTTP/2 flaws need only a default server and an unauthenticated client. Node-based gRPC servers belong here too: as far as we know they run on Node's http2 module, and gRPC traffic is often passed through to the backend as HTTP/2 rather than downgraded.

  2. Node processes that terminate HTTPS themselves (https.createServer or tls.createServer facing the internet). CVE-2026-123864 needs no HTTP/2 at all.

  3. Servers that use client certificates, especially with different rules per hostname (CVE-2026-123872, CVE-2026-123867).

Who can move second: if a reverse proxy or load balancer (nginx, a cloud load balancer, a CDN) terminates TLS and HTTP/2 and talks plain HTTP/1.1 to Node, the client's HTTP/2 frames and TLS handshake never reach Node, so most of the high-severity flaws are out of a stranger's reach. Check that the proxy really does downgrade: a proxy that passes HTTP/2 or TLS through to Node gives you no protection. Patch anyway; the release fixes a crash in the zlib streaming API and filesystem permission bugs too.



How to check


  • The version. Run node -v on the host or inside the running container. Fixed means v22.23.5, v24.22.3 or v26.13.1 or later on that line. Anything on 20, 23 or 25 is end-of-life, gets no fix, and Node says such versions "are always affected when a security release occurs."

  • The container image. Read the FROM line in your Dockerfile, then check what the running container actually holds: a floating tag only helps if you rebuilt after the fix shipped. A container built before November 10 is not fixed, whatever its tag says.

  • The official Docker images already carry the fix. We checked Docker Hub on November 12. The floating tags point at the same amd64 image as the fixed version tags: node:24-slim and node:24.22.3-slim (digest sha256:0e2646ab57e7...), node:22-slim and node:22.23.5-slim (sha256:47725aca53d3...), node:26-slim and node:26.13.1-slim (sha256:a5a5adfee301...). The same holds for node:22, node:24, node:26, node:22-alpine, node:24-alpine and node:24-bookworm-slim against their version tags. The images were pushed between 19:26 UTC on November 11 and 02:38 UTC on November 12. To pin to the fix, use the version tag (node:24.22.3-slim) or the digest, then rebuild and redeploy.

  • One surprise while you are in there. Node 26 is now the active LTS line (Lithium), and on Docker Hub node:lts-slim points at the same image as node:26.13.1-slim. If your Dockerfile says node:lts and you last built on Node 24, your next rebuild jumps a major version. Pin the line you tested.


How we know


We read the Node.js advisory and the nodejs.org download index, the CISA KEV JSON (version 2026.11.10), and the Docker Hub tag API for the official node image, all on November 12. The Hacker News article led us to it. Our edge check cannot see these flaws: they live in HTTP/2 frames and TLS handshakes, not in a URL path a scanner would request, so our edge telemetry can say nothing about whether anyone is trying them, and we make no claim either way. No indicators were published in the sources we read, so nothing was added to our feed.



Sources


If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.




Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.


Comments

Rated 0 out of 5 stars.
No ratings yet
Add a rating
bottom of page