Node.js patches 16 flaws; HTTPS bug leaks TLS private keys
Node.js 22.23.5, 24.22.3 and 26.13.1 fix 16 CVEs, including CVE-2026-123864, an HTTPS heap leak that can send one connection's TLS private keys to another unauthenticated client.
Node.js shipped its November 2026 security releases on 12 November, fixing 16 vulnerabilities — 7 high, 7 medium, 2 low — across the 22.x, 24.x and 26.x lines. The one to patch for first is CVE-2026-123864, a high-severity HTTPS flaw the project says lets "an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests."
The flaws that matter
CVE-2026-123864 — HTTPS cross-connection memory disclosure. A zero-length TLS write re-enters llhttp_execute(), and the server copies its own heap into the request body. It triggers when a handler calls res.flushHeaders() before the body has fully arrived, then calls res.end() with data. The leaked heap can include TLS private keys and other users' in-flight requests. Plain node:http servers are not affected — this is an HTTPS/TLS path. All three lines.
CVE-2026-123863 — HTTP/2 remote abort. A reachable assertion in HTTP/2 session teardown lets any unauthenticated client crash the server. A default HTTP/2 server that replies before the request body has fully arrived is enough, over both TLS and cleartext. Affects 24.x and 26.x.
CVE-2026-123866 — HTTP/2 freed-memory disclosure. HTTP/2 stream teardown can send freed response memory to the peer. All three lines.
Other high-rated issues in the set: CVE-2026-123865 (an HTTP/2 client can hold memory and file descriptors permanently), CVE-2026-123874 (memory corruption when serving files via respondWithFile() / respondWithFD()), CVE-2026-126051 (a client can crash a TLS server through SNICallback, OCSPRequest and related callbacks), and CVE-2026-123872 (a TLS 1.2 renegotiation bypass of stricter per-hostname client-certificate rules).
Affected and fixed
| Line | Fixed in | Status |
|---|---|---|
| 22.x | 22.23.5 | Supported |
| 24.x | 24.22.3 | Supported (current LTS) |
| 26.x | 26.13.1 | Supported |
| 20.x, 25.x | — | End-of-life; "always affected," no fix |
The project reports no workaround for servers that can't update yet, and no in-the-wild exploitation.
Action checklist
- Upgrade to 22.23.5, 24.22.3 or 26.13.1. There is no config mitigation.
- Rotate TLS material on HTTPS front ends. CVE-2026-123864 can disclose private keys from server memory; after patching, rotate the certificate's private key and reissue rather than assume you weren't hit.
- Audit for the vulnerable pattern. Code that calls
res.flushHeaders()and then streams a body, or that serves files withrespondWithFile()/respondWithFD(), is in the blast radius for the disclosure and corruption bugs. - Retire 20.x and 25.x. EOL lines get no patch and the advisory flags them as always affected — move to a supported line.
- Check embedded runtimes. Electron, serverless base images and appliance firmware pin a Node.js version; those need the bump too.
Context
Five of the fixes, including the HTTP/2 crash and the private-key leak, were reported by Chris Rohlf "in collaboration with Claude and Anthropic Research," per the advisory. That mirrors the discovery pipeline on this cycle's Apache mod_http2 RCE, where Anthropic's automated scanner filed alongside human researchers — machine-assisted review is now a standing source of HTTP/2 and TLS memory-safety findings, and the patch cadence on both stacks is tightening to match. HTTP/2's per-stream state machine keeps producing use-after-free and disclosure bugs under concurrency; "patch Node" has to mean the HTTP/2 and TLS paths specifically, not just the runtime version string.