Node.js has recently addressed a series of critical vulnerabilities, releasing updates for its three supported release lines, 22.23.5, 24.22.3, and 26.13.1. Among the fixed flaws are significant issues with the runtime's built-in HTTP/2 support, which allowed unauthenticated clients to crash servers and potentially leak data from other connections. These vulnerabilities, identified as CVE-2026-123863 and CVE-2026-123866, notably affected the 24.x and 26.x release lines. The crash issue could be exploited by default HTTP/2 servers responding before receiving the entire request body, while the memory leak could occur when a server closes a stream prematurely.
In addition, Node.js HTTPS servers were found to be vulnerable to another severe flaw, CVE-2026-123864, which could permit an unauthenticated client to access memory from other connections. This includes sensitive data like TLS private keys and other users' requests. All three supported Node.js lines are affected by this issue, which requires specific conditions such as calling res.flushHeaders() prematurely and subsequently using res.end() with data.
The security update addresses a total of 16 vulnerabilities, seven of which are rated as high severity. These issues primarily affect Node.js's own HTTP/2, HTTPS, and TLS server code, making the update critical for environments where Node.js handles these types of connections directly. The Node.js project advises updating to the latest fixed versions to mitigate these risks, as there are no reported workarounds for servers unable to update immediately. However, end-of-life versions, such as 20.x and 25.x, will not receive any fixes in this release.
Despite the severity of the vulnerabilities, the advisory does not mention any known exploits in the wild, nor does it recommend replacing TLS keys or other secrets post-update. Notably, five of these flaws, including the HTTP/2 and HTTPS server issues, were reported by Chris Rohlf in collaboration with Claude and Anthropic Research.
