This week, Node.js has rolled out critical updates to address significant vulnerabilities affecting its HTTP/2 implementation, impacting versions 24.x and 26.x. These flaws allowed unauthenticated clients to potentially crash servers or access unintended data from other connections.
Details of the HTTP/2 Flaws
The vulnerabilities, identified as CVE-2026-123863 and CVE-2026-123866, were found in the runtime’s built-in HTTP/2 support. The first flaw enables server crashes when default HTTP/2 servers respond before the complete request body is received. The second flaw could result in servers inadvertently sending memory content, including data meant for other connections, to clients.
To mitigate these issues, Node.js has released patched versions for all supported lines: 22.23.5, 24.22.3, and 26.13.1. These updates are crucial for maintaining server integrity and preventing unauthorized data access.
Additional Vulnerabilities and Security Risks
Another critical vulnerability, CVE-2026-123864, impacts HTTPS servers, potentially allowing data leakage, including TLS private keys, if certain conditions are met. This flaw affects all supported versions and requires specific server configurations to be exploitable.
In total, 16 vulnerabilities within Node.js have been addressed, with seven categorized as high severity. Among them, CVE-2026-123865 can cause servers to indefinitely hold memory and file descriptors, while CVE-2026-123874 and CVE-2026-123875 can lead to memory corruption and server crashes under specific file serving conditions.
Implications for Node.js Users
Node.js users are advised to update to the latest versions immediately to safeguard their applications. The security advisory highlights that while no attacks exploiting these vulnerabilities have been reported yet, the potential for significant security breaches underscores the urgency for updates.
For lines beyond their end-of-life, such as 20.x and 25.x, no fixes are provided, emphasizing the importance of using supported versions. Although no specific attack vectors are detailed, the advisory suggests a proactive update to mitigate potential risks.
Five of these vulnerabilities, including the prominent HTTP/2 issues, were discovered by Chris Rohlf in collaboration with Claude and Anthropic Research, showcasing the importance of collaborative efforts in identifying and resolving security threats.
Overall, this update is a crucial step for Node.js users to enhance their systems’ security and prevent possible exploitation of these vulnerabilities.
