The Node.js project has rolled out updates addressing 16 security vulnerabilities in its 22.x, 24.x, and 26.x versions. Of these, seven are classified as high-risk, six as medium-risk, and three as low-risk. The updated versions available are v22.23.5, v24.22.3, and v26.13.1, which also include refreshed components like llhttp, undici, and sqlite.
Memory Leak Threatens TLS Security
A significant issue, labeled CVE-2026-123864, poses a high security risk by affecting HTTPS codes across all three Node.js lines. This flaw allows unauthorized clients to access memory belonging to other connections, potentially exposing TLS private keys. It results from a re-entry issue where a zero-length TLS write causes a use-after-free error, leading to old memory being inadvertently copied into request bodies. Only servers using specific handler calls are vulnerable, with plain node:http remaining unaffected.
Critical Flaws in HTTP/2 Implementation
Several vulnerabilities stem from the HTTP/2 code, notably CVE-2026-123863, which enables any client to abort a default HTTP/2 server. This issue is similar to a previous flaw, CVE-2024-27983, that was inadequately patched earlier. Additionally, vulnerabilities like CVE-2026-123874 and CVE-2026-123875 can lead to server crashes or memory corruption when handling file transfers. Another critical issue, CVE-2026-123866, involves the potential transmission of freed memory to a peer, risking data leakage.
Medium severity issues, such as CVE-2026-123868, allow clients to overload servers by sending small data frames, while CVE-2026-123828 can trigger a process abort through a one-byte heap overflow.
Implications for Login and Certificate Validations
Security concerns also extend to authentication and certificate verification processes. CVE-2026-123872 permits clients to alter server names during TLS 1.2 renegotiations, potentially bypassing client certificate checks. Moreover, CVE-2026-123867 and CVE-2026-123877 highlight weaknesses in TLS session handling, allowing inappropriate access under certain conditions.
The release also addresses lower-risk issues affecting the Permission Model and zlib, such as CVE-2026-123829, which discloses file names on macOS and Windows platforms.
Researchers, including Chris Rohlf and teams from Claude and Anthropic Research, identified these vulnerabilities, with Matteo Collina and others implementing most fixes. This update follows a brief notice period without specific CVE details, now fully disclosed.
Action and Future Considerations
Organizations are urged to upgrade to the latest Node.js versions promptly, especially for public HTTP/2 and HTTPS servers. It’s advisable to regenerate TLS keys for any servers that may have been compromised. Additionally, entities should transition from end-of-life versions, as they remain susceptible to security threats.
Maintaining robust network security requires staying informed and prepared for rapid incident response. Integrating threat intelligence across Security Operation Centers (SOCs) can enhance defense mechanisms against potential exploits.
