Node.js 26.13.1, 24.22.3 and 22.23.5 Fix Seven High-Severity HTTP/2 and TLS Flaws

The Node.js project shipped security releases for all three supported lines on November 11, 2026: Node.js 26.13.1, 24.22.3 and 22.23.5. The advisory covers 16 CVEs, seven rated high, and most of them sit in the HTTP/2 and TLS code that public servers rely on every day.

Several of the bugs can be triggered by a remote client with no credentials. Depending on the flaw, an attacker can crash a server, leak server memory to the network, keep connections alive forever, or get past client certificate checks. Anyone running Node.js as an HTTPS or HTTP/2 server should plan an upgrade this week.

Which versions to install

Each supported release line received one patched build. All three are tagged as security releases, so they carry only fixes and dependency bumps, not new features.

• Node.js 26.13.1 'Lithium' (LTS): the new LTS line, which only became LTS with 26.13.0.
• Node.js 24.22.3 'Krypton' (LTS): the previous active LTS line.
• Node.js 22.23.5 'Jod' (LTS): the maintenance LTS line.

The project notes that releases past their end of life are treated as vulnerable by default and receive no patch, so the only safe path for them is to move to a supported line.

The high-severity bugs

The seven high-rated issues mostly come down to memory handling during connection and stream teardown. In plain terms, Node.js freed or abandoned an object while some other part of the server still expected it to exist.

• CVE-2026-123863: an HTTP/2 client can make a stream outlive its session, which trips an internal assertion and kills the process. It is a gap left by the earlier fix for CVE-2024-27983 and affects the 24.x and 26.x lines.
• CVE-2026-123864: a zero-length TLS write issued while the HTTP parser is still reading a body can re-enter the parser. The server may then copy unrelated heap memory, possibly including private keys or other users' requests, into a request body.
• CVE-2026-123865: a protocol error sent while an HTTP/2 session is already closing leaves the session dangling, so memory and file descriptors are never released.
• CVE-2026-123866: tearing down an HTTP/2 stream while a write is backed up can send freed memory from other responses to the peer.
• CVE-2026-123872: under TLS 1.2 renegotiation or session resumption, a client could switch the server name and carry its client certificate login to a host with a stricter policy.
• CVE-2026-123874: a use-after-free when a stream served with respondWithFile() or respondWithFD() is cancelled by the client while a write is still queued (24.x and 26.x).
• CVE-2026-126051: TLS servers that use SNI, OCSP or session hooks can be crashed by a crafted handshake that destroys the socket before a deferred callback runs (24.x and 26.x).

Medium and low issues

The six medium bugs widen the HTTP/2 and TLS picture. One is a one-byte heap overflow in altsvc() when an app passes a long, attacker-supplied origin. Another lets queued inbound HTTP/2 data escape the maxSessionMemory limit, so a single stream can hold hundreds of megabytes.

Two medium fixes target trust decisions. A CA-only SNI context could silently fall back to the default client CA, and https.Agent could reuse a TLS session across two different CA policies. A further fix stops proxy usernames and passwords from leaking into ERR_PROXY_INVALID_CONFIG error text, and another stops a crash when a client cancels a file download over HTTP/2.

The low-rated items affect fewer apps. Two are Permission Model gaps: recursive fs.watch on macOS and Windows could reveal names of denied files, and a wildcard filesystem grant could match a shorter path than intended. The third is a zlib crash when params() runs on a stream that has already been destroyed.

The releases also update bundled dependencies. All three lines move to llhttp 9.4.4 and SQLite 3.54.1, while 24.x and 26.x also get brotli 1.2.1 and newer undici builds.

What it means for developers

If your service terminates HTTPS or HTTP/2 inside Node.js, treat this as an urgent patch. Several flaws need no login and no unusual configuration, only a default server and a hostile client. Memory disclosure bugs are the most serious, since leaked heap data can include keys and other users' traffic.

Apps that sit behind a reverse proxy or load balancer which ends TLS are less exposed to the TLS issues. Even so, HTTP/2 between the proxy and Node.js can still reach the affected code. Teams that rely on per-host mutual TLS rules should test those rules after the upgrade, because several fixes change how certificates and TLS sessions are checked.

Developers who use the Permission Model as a sandbox should review wildcard grants. A rule such as a read grant on a file pattern may have allowed more than it looked like before this release.

How to upgrade

Install the new build for your line from nodejs.org, or through your version manager, container base image or OS package source once it picks up the release. Rebuild Docker images rather than relying on cached layers.

• Check the running version with node -v on every host and in CI.
• Pin images to 26.13.1, 24.22.3 or 22.23.5 and redeploy.
• If you are still on an end-of-life line, schedule a move to a supported LTS release, such as the new Node.js 26 LTS line.

Conclusion

The November 2026 Node.js security release is one of the larger ones of the year, with 16 CVEs and a strong focus on HTTP/2 and TLS. The fixes are small in code size but close remote crash, memory leak and authentication bypass paths. Upgrading to 26.13.1, 24.22.3 or 22.23.5 is the only real fix.

Sources

• Node.js: Wednesday, November 11, 2026 Security Releases
• Node.js 26.13.1 (LTS) release notes
• Node.js 24.22.3 (LTS) release notes
• Node.js 22.23.5 (LTS) release notes