Node.js fixes HTTP/2 and TLS flaws exposing data and keys

The Node.js project released security updates 26.13.1, 24.22.3 and 22.23.5, addressing 17 vulnerabilities across the 26.x, 24.x and 22.x lines. The majority are HTTP/2 and TLS memory-leak flaws that can allow an unauthenticated client to crash a server or, in the worst cases, expose TLS private keys and other users’ requests. The advisory notes seven vulnerabilities are rated high, with a possible service disruption from HTTP/2 crashes and the more serious memory-leak issues.

At the time of the notice, no public exploits or confirmed active exploitation had been reported. None of the CVEs listed are in CISA’s Known Exploited Vulnerabilities catalog.

Key fixes include CVE-2026-123828, described as a heap-buffer overflow in HTTP/2 session[.]altsvc() via a long origin; it is fixed in 24.22.3 and 26.13.1.

Several HTTP/2 and TLS issues threaten memory management and session teardown: CVE-2026-123863 (stream outlives its session), CVE-2026-123865 (shutdown protocol errors leaking memory and file descriptors), CVE-2026-123866 (backpressured write teardown leaking freed memory to peers), CVE-2026-123874 (resetting a respondWithFile() stream during a pending write), CVE-2026-123868 (undrained data escaping maxSessionMemory).

Other TLS-related bypass risks include CVE-2026-123872 (servername change during TLS renegotiation), CVE-2026-123867 and CVE-2026-123877 (CA policy interactions) and CVE-2026-126051 (TLS server crash with SNI/OCSP). Affected versions are Node.js 26.x before 26.13.1, 24.x before 24.22.3, and 22.x before 22.23.5.

The guidance from the Node.js team is to upgrade to the patched releases (26.13.1, 24.22.3 or 22.23.5), restart all Node.js processes and rebuild containers and executables. Until patching, operators were advised to consider placing HTTP/2 services behind a terminating proxy and to review per-host client-certificate rules. The disclosures credit Chris Rohlf and others, with Matteo Collina contributing many fixes.