Node.js fixes 16 security flaws: update to 26.13.1, 24.22.3 or 22.23.5
The Node.js project released security fixes for all supported lines on 11 November 2026, including high-severity issues in HTTPS, HTTP/2 and TLS. Here is what changed and what to update.
On this page
The Node.js project published security releases on Wednesday, 11 November 2026 for all three supported release lines. The new versions are Node.js 26.13.1, 24.22.3 and 22.23.5. The project rates the most serious issues in each line as high severity.
If your website, API or build tooling runs on Node.js, this is an update to schedule now.
What was fixed
The advisory lists 16 vulnerabilities: seven rated high, six medium and three low. Most of them sit in the parts of Node.js that talk to the network: the HTTP/2 implementation, HTTPS and TLS.
The release also updates three bundled dependencies: llhttp on all three lines, undici on 24.x and 26.x, and sqlite on 22.x and 24.x.
The high-severity issues
Several of the high-severity issues can be triggered by a client that does not need to log in.
- HTTPS memory disclosure (CVE-2026-123864). A flaw in how a zero-length TLS write is handled lets an unauthenticated client read memory that belongs to other connections. The advisory says this can include TLS private keys and other users' requests. Plain, unencrypted
node:httpservers are not affected. - HTTP/2 server crash (CVE-2026-123863). Any unauthenticated client can make an HTTP/2 server abort, over TLS or cleartext. The advisory describes it as a variant of an earlier issue that a previous fix did not cover.
- HTTP/2 leaks after protocol errors (CVE-2026-123865). Sessions that hit a protocol error during shutdown are never cleaned up, so an attacker can leak memory and file descriptors.
- HTTP/2 stream teardown (CVE-2026-123866). During a backpressured teardown, freed response memory can be sent to the peer.
- TLS server crash (CVE-2026-126051). A remote client can crash a TLS server by destroying the socket before a deferred handshake callback runs. This affects 24.x and 26.x.
- TLS 1.2 renegotiation (CVE-2026-123872). A client can renegotiate under a different server name and carry its authentication to a host that has a stricter client certificate policy.
respondWithFile()use-after-free (CVE-2026-123874). Applications that serve files over HTTP/2 withrespondWithFile()orrespondWithFD()can dereference freed memory when a stream is reset mid-write. This affects 24.x and 26.x.
Medium and low issues
The medium-severity fixes include a case where an https.Agent could reuse a TLS session across different certificate policies and report a request as authorised when it should not be, and a case where a per-host client CA set with server.addContext() silently fell back to the default CA. Another fix stops proxy credentials from appearing in some error messages. Others cover memory limits in HTTP/2 and crashes when a file download is cancelled.
The three low-severity fixes concern the Node.js Permission Model and a zlib crash that only affects apps calling deflate.params() while streaming.
Older versions
The advisory states that end-of-life versions are always affected when a security release happens. If you still run a release line older than 22.x, the fix is to move to a supported line, using the Node.js release schedule.
What it means for your site
- Find out which Node.js version you run. Check
node -von your servers, your hosting or build settings, your Dockerfiles and your CI configuration. A pinned version in any of these will not update itself. - Update to the fixed release for your line. That is 26.13.1, 24.22.3 or 22.23.5.
- Prioritise anything that faces the internet. Servers that accept HTTPS or HTTP/2 traffic directly are most exposed to the high-severity issues. Build machines and internal tools should follow.
- Check your hosting provider. If a platform runs Node.js for you, look at its release notes to see when it picks up the new versions, or whether you need to select one yourself.
- Leave unsupported lines behind. Anything older than 22.x will not receive these fixes.
The Node.js project announces security releases on its low-volume nodejs-sec mailing list, which is worth following if you run Node.js in production.
