Skip to content
audiotale.net
Sign in
NewsNews

Node.js 26.13.1, 24.22.3 and 22.23.5 fix 15-16 CVEs, 7 rated High: update now

Security releases for all three supported Node.js lines fix High-severity HTTP/2 and TLS flaws, including a remotely reachable TLS server crash; here is who is affected and what to do.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Node.js published security releases for all three supported lines on 11 November 2026: 26.13.1, 24.22.3 and 22.23.5. Together they fix 15 to 16 CVEs, the most serious rated High, and most of the High-rated fixes sit in the HTTP/2 and TLS code that many servers expose directly to the internet. If you run Node.js in production, this is an update to schedule today.

Key points

  • Node.js 26.13.1, 24.22.3 and 22.23.5 were released on 11 November 2026 and each is labelled "a security release" in the project's release notes.
  • The 26.x and 24.x notes list 16 CVEs (7 High, 6 Medium, 3 Low); the 22.x notes list 15, because CVE-2026-126051 (a remotely reachable TLS server crash) is not in the 22.x list.
  • The project's advisory says the highest severity in every line is High, and that end-of-life versions, which get no fix, are always affected.
  • The previous releases were 26.13.0 (28 October), 24.22.2 (28 October) and 22.23.4 (21 October), according to endoflife.date.
  • Node.js 20 reached end of life on 30 April 2026 and 25.x on 1 June 2026, so neither line receives these fixes.

What to do

  • Who is affected: anyone running Node.js 26.x, 24.x or 22.x below the fixed versions, and anyone on an end-of-life line (20.x, 25.x and older), which is affected and has no patch.
  • Fixed versions: 26.13.1, 24.22.3, 22.23.5. Installers and binaries are linked from each release page on nodejs.org; container images and OS packages follow the project's tags, so check your distribution's own advisory before assuming a rebuild has them.
  • Check your version: run node --version on servers and inside containers, and look at the base image tag in your Dockerfiles. Pinned node:24 style tags only pick up the fix after the image is rebuilt and redeployed.
  • Prioritise: services that terminate TLS or serve HTTP/2 directly from Node.js, especially anything with mutual TLS (mTLS) client certificates, since several High fixes touch those paths.
  • If you cannot upgrade today: the release notes name no workaround. Putting a patched reverse proxy in front of the process is a general mitigation for protocol-level bugs, but we have not seen the project recommend it for these specific CVEs.
  • Moving off an old line: 22.x stays supported until 30 April 2027, 24.x until 30 April 2028 and 26.x until 30 April 2029, per endoflife.date.

What happened

The Node.js project pre-announced the release on 4 November on the oss-security mailing list: new versions of the 22, 24 and 26 lines "on or shortly after" 11 November, with the highest severity being High. The advisory page gave no CVE list in advance, which is normal for the project. On 11 November the three releases appeared, each listing its security fixes under "Notable Changes" with a severity next to every item.

The High-rated entries in the 26.x and 24.x notes are:

  • CVE-2026-123863: HTTP/2, release headers when a stream is removed.
  • CVE-2026-123864: TLS and HTTP, prevent nested parser execution from empty writes.
  • CVE-2026-123865: HTTP/2, detect streams abandoned by nghttp2.
  • CVE-2026-123866: HTTP/2, retain buffers until socket writes finish.
  • CVE-2026-123872: TLS, three related changes: disable resumption for mTLS with no session id context, and stop renegotiation, HelloRetryRequest or resumption from changing the SNI (server name).
  • CVE-2026-123874: HTTP/2, retain streams during pending writes.
  • CVE-2026-126051: TLS, fix a remotely reachable TLS server crash (26.x and 24.x only).

The Medium entries are CVE-2026-123828 (HTTP/2 ALTSVC buffer overflow guard), CVE-2026-123867 (applying the CA of SNI contexts that have no certificate), CVE-2026-123868 (charging inbound HTTP/2 DATA held by streams to maxSessionMemory), CVE-2026-123871 (redacting proxy credentials in invalid proxy URL errors), CVE-2026-123875 (a null write request on a cancelled HTTP/2 stream) and CVE-2026-123877 (isolating HTTPS Agent TLS policy keys). The Low entries are CVE-2026-123829 and CVE-2026-123873, both in the permission model (a recursive fs.watch leak and a heap snapshot destination check), and CVE-2026-123862 (a zlib params callback after destroy).

The release notes only give one-line descriptions. We could not open the CVE records themselves (NVD blocked our request), so we do not describe attack details or scores beyond what the notes say. Read the individual advisories before deciding how urgent your own exposure is.

Background

Node.js has shipped security releases on a steady cadence this autumn. The project's blog lists a release on 21 October, and endoflife.date shows 22.23.4 shipped that day, with 26.13.0 and 24.22.2 following on 28 October.

HTTP/2 and TLS are the recurring theme. Both are complex state machines where lifetime errors (a stream or buffer freed too early, or held too long) become crashes or memory exhaustion. The titles in this release follow that pattern: "retain streams during pending writes", "retain buffers until socket writes finish" and "release headers when a stream is removed" all describe object lifetimes.

The numbers

Counting the entries in the 26.x notes by their stated severity:

CVEs fixed in Node.js 26.13.1 by severityCVEs
CVEs fixed in Node.js 26.13.1 by severity (CVEs)
CVEs
High7
Medium6
Low3

Source: Node.js 26.13.1 release notes

The 22.x notes list 6 High, 6 Medium and 3 Low. The three releases also update bundled dependencies: llhttp 9.4.4 and SQLite 3.54.1 appear in all three, brotli 1.2.1 in 26.x and 24.x, and undici 7.30.2 in 24.x (26.x lists undici 8.12.4).

Line Fixed version Previous CVEs listed Support ends
26.x 26.13.1 26.13.0 16 30 April 2029
24.x 24.22.3 24.22.2 16 30 April 2028
22.x 22.23.5 22.23.4 15 30 April 2027

What it means

For teams running Node.js directly on the internet, the HTTP/2 and TLS fixes are the part to read first. A "remotely reachable TLS server crash" is the kind of bug that matters for any public HTTPS endpoint served by Node itself, because a client that can connect can trigger it. Teams that terminate TLS at a load balancer or CDN and speak plain HTTP/1.1 to Node have less exposure to these particular fixes, though the HTTP parser and dependency updates still apply.

The three SNI-related changes under CVE-2026-123872 matter most to anyone using mutual TLS or per-host certificates, where a server picks policy by the requested name. The notes say resumption and renegotiation can no longer change the SNI, which suggests that policy chosen at the start of a connection could previously be bypassed later; the notes do not spell this out, so check the advisory.

For tooling and platform teams, the practical work is rebuilding images. A Node.js patch that lands in a base image tag does nothing until every service image is rebuilt and rolled out, so track the version actually running, not the version in the lockfile or the engines field.

For anyone still on Node.js 20 or 25, this is a reminder that end-of-life lines are listed as affected and will not be fixed. The Node.js project points users to commercial support partners for versions past maintenance.

What we don't know yet

  • The severity scores (CVSS) and exploit conditions for each CVE; we could not open the CVE records.
  • Whether any of the issues is being exploited. Nothing in the release notes says so, and we found no report saying it.
  • Whether the High-rated issues need a specific configuration such as HTTP/2 enabled or client certificates.
  • When distribution packages (Debian, Ubuntu, Alpine, Red Hat) and official Docker images will carry the fixes.

What to watch next

Watch the individual CVE advisories as they are published, your distribution's Node.js package advisories, and the Docker official image tags. The project's next scheduled release is posted on its blog's vulnerability page. If you maintain libraries that bundle their own HTTP client, also check undici, which was updated in these releases.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next