Node.js Patches 16 Vulnerabilities, Including HTTP/2 Crashes and Cross-Connection Memory Leaks

Node.js has released fixes for 16 vulnerabilities in the runtime, seven of them rated high, with HTTP/2 and HTTPS server bugs among the most serious. Fixed versions are 22.23.5, 24.22.3 and 26.13.1.

One HTTP/2 flaw, CVE-2026-123863, lets an unauthenticated client crash servers on the 24.x and 26.x lines. It only needs a default HTTP/2 server that replies before the request body has fully arrived - behavior the project calls typical - and works over both TLS and cleartext connections.

A second HTTP/2 bug, CVE-2026-123866, can cause a server to send a client fragments of its memory, including responses meant for other connections. From 24.22.0 and 26.9.0 onward a client can trigger it alone; on 22.x and older 24.x and 26.x builds it can still occur when the server closes a stream partway through a response, such as after an idle timeout.

Separately, CVE-2026-123864 in Node.js HTTPS servers can let an unauthenticated client read memory from other connections, "including TLS private keys and other users' requests," according to the project. It requires a handler that calls res.flushHeaders() before the request body arrives and later calls res.end() with data, plus a route that sends back or stores a request body. Plain node:http servers are unaffected.

The remaining high-rated flaws include CVE-2026-123865, where a client can make any default HTTP/2 server hold memory and file descriptors permanently; CVE-2026-123874, allowing memory corruption on 24.x and 26.x via stream.respondWithFile() or stream.respondWithFD(); CVE-2026-126051, a crash on TLS servers using SNICallback, OCSPRequest, newSession, resumeSession or server.addContext(); and CVE-2026-123872, where a client approved for one hostname can switch to a stricter one during TLS 1.2 renegotiation without meeting its rules.

Updating is the only fix listed in the advisory, with no workaround offered. End-of-life lines including 20.x and 25.x receive no patch and are described as always affected. The advisory reports no attacks using the flaws and does not say whether servers meeting the HTTPS flaw's conditions should replace TLS keys or other secrets after updating. Five flaws, including CVE-2026-123863 and CVE-2026-123864, were reported by Chris Rohlf in collaboration with Claude and Anthropic Research.

Source: The Hackers News