Node.js Fixes 16 Flaws Including HTTP/2 Crash and Leak Bugs

Fixed versions are out for all supported lines: 22.23.5, 24.22.3 and 26.13.1.

Key flaws

• CVE-2026-123863: crashes a default HTTP/2 server on 24.x and 26.x when the server replies before the request body fully arrives, which the project calls typical behavior. It works over TLS and cleartext.
• CVE-2026-123866: a server may send a client pieces of its memory, including responses meant for other connections. All three lines are affected, and from 24.22.0 and 26.9.0 a client alone can trigger it.
• CVE-2026-123864: on HTTPS servers, an unauthenticated client may read memory from other connections, including TLS private keys. It requires a handler that calls res.flushHeaders() before the body arrives. Plain node:http servers are not affected.

Other high-severity flaws

• CVE-2026-123865: permanent memory and file descriptor exhaustion on default HTTP/2 servers.
• CVE-2026-123874: memory corruption when serving files via respondWithFile() or respondWithFD().
• CVE-2026-126051: crash of TLS servers using hooks such as SNICallback.
• CVE-2026-123872: client-certificate rule bypass during TLS 1.2 renegotiation.

What to do

1. Update Node.js to the fixed release for your line now, and rebuild Docker images that ship older versions.
2. Prioritize servers that accept HTTP/2 or HTTPS directly from the internet without a reverse proxy.
3. If Node.js terminates HTTPS itself, consider rotating TLS keys after patching as a precaution.