Node.js

Node.js released fixes this week for a cluster of server-side vulnerabilities, and the worst one is not a crash. It is a memory disclosure that can hand an unauthenticated client pieces of the server's memory, including TLS private keys and responses intended for other connections.

Fixed versions are out for all three supported lines: 22.23.5, 24.22.3, and 26.13.1.

The Three Headline Flaws

The HTTPS one is the one to read carefully. The Node.js project describes it as allowing an unauthenticated client to read memory from other connections, "including TLS private keys and other users' requests."

Reading the leaked memory also requires a route that sends back or stores a request body. Plain HTTP servers built with node:http are not affected.

The HTTP/2 Crash Is Trivially Reachable

CVE-2026-123863 needs only a default HTTP/2 server that replies before the request body has fully arrived. Node.js describes that behavior as typical.

That is the part worth pausing on. The project is not describing an unusual configuration. It is describing normal request handling.

The crash works over both TLS and cleartext connections. No authentication, no special setup, just a client that sends a request the server responds to early.

The Memory Flaw's Version Split

CVE-2026-123866 affects all three lines, but the trigger condition depends on the version.

From 24.22.0 and 26.9.0 onward, a client alone can trigger it.

On 22.x and older 24.x and 26.x builds, it can still be triggered when the server itself closes a stream partway through a response, for example after an idle timeout.

That is a meaningful difference for anyone on the 22.x line. The flaw is real there, it just needs a slightly different sequence to fire.

The Other High-Rated Flaws

The release fixes 16 vulnerabilities in Node.js itself, seven of them rated high. Four more high-rated flaws round out the list.

CVE-2026-123865 is worth its own note. A client can make any default HTTP/2 server hold memory and file descriptors permanently. That is a denial-of-service that does not require a crash. The server just keeps holding resources it will never release.

Where These Flaws Actually Live

All eight flaws described above are in Node.js's own HTTP/2, HTTPS, and TLS server code.

That means they matter specifically where a Node.js process accepts those connections itself. If you run Node.js behind a reverse proxy that terminates TLS and HTTP/2, the exposure profile is different.

If your Node.js process is the one accepting connections, these are your problem.

How to Patch

Updating to the fixed version for each line is the only fix in the project's security advisory. It lists no workaround for servers that cannot update yet.

• 22.x: 22.23.5
• 24.x: 24.22.3
• 26.x: 26.13.1

End-of-life lines, including 20.x and 25.x, get no fix in this release. The project states that such versions are always affected.

The Disclosure Gaps

The advisory does not report any attacks using the flaws. It also does not say whether servers that met the conditions for the HTTPS flaw should replace their TLS keys or other secrets after updating.

That second gap matters. CVE-2026-123864 can expose TLS private keys. If a server was exposed and someone read that memory, updating the software closes the future exposure but does not un-leak the key.

Node.js has not said whether rotation is required. Security teams should decide for themselves rather than wait for guidance that may not come.

Who Found Them

Five of the flaws, including CVE-2026-123863 and CVE-2026-123864, were reported by Chris Rohlf in collaboration with Claude and Anthropic Research, according to the advisory.

That is another data point in the pattern we have been tracking. AI-assisted vulnerability research is now surfacing high-severity flaws in widely deployed runtimes on a regular schedule.

What Defenders Should Do

• Update all three supported lines immediately. 22.23.5, 24.22.3, and 26.13.1.
• Restart the process. A running Node.js process keeps the old binary until it restarts.
• Rotate TLS private keys if your server met the conditions for CVE-2026-123864. The advisory does not require it, but it also does not rule it out.
• Review your HTTP/2 exposure. If your Node.js process accepts HTTP/2 connections directly, every flaw in this list applies to you.
• Check for permanent resource hold. CVE-2026-123865 can leave file descriptors and memory held indefinitely. Monitor for unusual resource growth on servers that have been internet-facing.
• Audit your TLS callbacks. CVE-2026-126051 fires through SNICallback, OCSPRequest, newSession, resumeSession, and server.addContext(). Know whether you use them.
• Plan an upgrade off 20.x and 25.x. End-of-life lines get no fixes, and the project is explicit that they are always affected.

FAQ

What did Node.js fix this week?

Sixteen vulnerabilities in Node.js itself, seven rated high, including three in HTTP/2 and HTTPS server code that are the focus of this article.

Which versions fix them?

22.23.5 for the 22.x line, 24.22.3 for 24.x, and 26.13.1 for 26.x.

Can an unauthenticated client really read TLS private keys?

CVE-2026-123864 can leak memory from other connections, including TLS private keys, under specific conditions. The handler must call res.flushHeaders() before the request body fully arrives and later call res.end() with data.

Does my server need a specific configuration to be vulnerable?

For the HTTPS flaw, yes. For the HTTP/2 crash (CVE-2026-123863), a default HTTP/2 server that replies before the request body fully arrives is enough. Node.js describes that behavior as typical.

Is plain HTTP affected?

Plain HTTP servers built with node:http are not affected by the HTTPS memory flaw.

Is there a workaround?

The Node.js advisory lists no workaround. Updating is the only fix.

Should I rotate my TLS keys after patching?

Node.js does not say whether rotation is required. Given that private keys can be exposed, rotation is the prudent choice for any server that met the exposure conditions.

What about Node.js 20.x and 25.x?

They are end-of-life and receive no fix in this release. The project says such versions are always affected.

Is anyone exploiting these flaws?

The advisory does not report any attacks using them.

Who reported the flaws?

Five of them, including CVE-2026-123863 and CVE-2026-123864, were reported by Chris Rohlf in collaboration with Claude and Anthropic Research.

Source: The Hacker News