The Node.js project published versions 26.13.1, 24.22.3 and 22.23.5 on November 11, 2026. They fix 16 vulnerabilities with CVEs: seven high, six medium and three low. Last week's pre-announcement only said there would be high-severity fixes, as I covered in Node.js 26, 24 and 22 get security fixes on November 11. The details are now public, and they make it clearer who needs to update first.
Where the flaws are
Almost everything serious sits in Node's own HTTP/2 server and TLS layer. Among the seven high-severity issues, according to the advisory:
- an unauthenticated client can crash an
http2server running with default settings, over TLS or cleartext (CVE-2026-123863), or a TLS server that usesSNICallback, OCSP orserver.addContext()(CVE-2026-126051); - over HTTPS, calling
res.flushHeaders()before the request body ends and laterres.end()with a chunk can make the server copy its own memory into the request body, which may expose TLS private keys and other users' requests (CVE-2026-123864); cleartextnode:httpis not affected; - in HTTP/2, stream teardown can send response data from other connections to the client (CVE-2026-123866), and serving files with
respondWithFile()opens a path to memory corruption (CVE-2026-123874); - a client can keep HTTP/2 sessions open indefinitely, leaking memory and file descriptors (CVE-2026-123865);
- on servers with different client-certificate rules per hostname, TLS 1.2 renegotiation lets a client switch hostname and carry its authentication from one host to another (CVE-2026-123872).
Two of the medium issues also touch authentication: an SNI context that sets only a CA falls back to the default CA and admits clients it should reject (CVE-2026-123867), and https.Agent can reuse a TLS session validated against the default trust store for a request that asked for a stricter policy (CVE-2026-123877). Another medium issue writes the proxy URL, username and password included, into ERR_PROXY_INVALID_CONFIG error messages, which usually end up in logs and error-tracking tools (CVE-2026-123871). The three low-severity issues involve the Permission Model and zlib.
The releases also update dependencies: llhttp on all three lines, undici on 24 and 26, and SQLite on 22 and 24.
Who needs to hurry
The advisory lists all three supported lines as affected. Some high-severity issues, such as CVE-2026-123863 and CVE-2026-123874, apply only to 24 and 26. The priority order below is my own assessment, based on the conditions described in each CVE.
At the top are services that expose Node directly to the internet and terminate TLS or HTTP/2 in the Node process: native http2 or https servers, frameworks configured to serve HTTP/2, and services using mTLS (mutual certificate authentication) with per-hostname rules. In those setups, an anonymous client can take the service down or read memory.
When a CDN, load balancer or reverse proxy terminates TLS and talks HTTP/1.1 to Node, most of the HTTP/2 and TLS server flaws never reach the application. What remains are the client-side fixes (https.Agent), the proxy credential leak in logs and the llhttp updates, which apply to any HTTP server. This group should update too, with less urgency.
Node 20 and 25 have already left security support, on April 30 and June 1, 2026, according to endoflife.date. The advisory says end-of-life versions "are always affected" when a security release ships, and they get no patch. For anyone still on them, this is a migration decision, and what weighs on it was the subject of A supported version still calls for a migration decision.
What to do now
- Move to 26.13.1, 24.22.3 or 22.23.5, depending on your line. These are patches within the same line, with no major version change.
- Rebuild Docker images from an updated tag. A container that keeps running keeps the old binary.
- On managed platforms that pick the runtime for you, check with the provider when the new version lands and whether the switch is automatic.
- Search logs and error-tracking tools for proxy URLs containing credentials, and rotate those passwords if they show up: the fix stops new leaks but does not erase what was already recorded.
If you fall into the first group, I would treat this as work for this week. The advisory sets no deadline and does not mention active exploitation.
What is still unclear
The advisory does not say whether any of the flaws are already being exploited, and it gives no CVSS score for each one. It also does not say when official images and managed providers will ship the new versions. If any of them lands in CISA's Known Exploited Vulnerabilities catalog, the priority rises for services behind a proxy as well.
If your company is weighing something similar, reach me on LinkedIn or WhatsApp.
