Node.js Patches 16 Security Flaws Across the 22, 24 and 26 Lines

The Node.js project shipped a security release on November 11, 2026, covering all three active lines: 22.x, 24.x and 26.x. Sixteen vulnerabilities are fixed, nine of them rated high severity, most of them in the HTTP/2 module and the TLS layer. Versions 22.23.5, 24.22.3 and 26.13.1 are recommended without delay for any server facing unauthenticated clients.

#Sixteen fixes, an unusually large batch

The release spreads fixes across three severity tiers: nine high, six medium, one low. Several enable denial-of-service or memory-disclosure scenarios that can be triggered remotely, with no authentication required. Two of them are variants or incomplete fixes of issues patched before, a sign of how hard it is to close certain bug classes in the runtime’s HTTP/2 implementation for good, barely a month after Node.js 26 entered long-term support under the Lithium codename.

#HTTP/2 and TLS are the hot spots

Seven of the sixteen fixes touch the HTTP/2 module directly: use-after-free during stream teardown, a one-byte buffer overflow in session.altsvc(), or sessions stuck in CLOSE_WAIT because cleanup never ran after a protocol error. On the TLS side, a re-entrant call to llhttp_execute() triggered by a zero-length write can cause use-after-free and leak in-flight request bodies. Another flaw lets a client change the servername mid TLS 1.2 renegotiation, bypassing per-host client-certificate policies.

#The permission model let wildcards over-grant

CVE-2026-106071 affects apps launched with the experimental permission model. A rule that looks restrictive can actually grant far more than intended:

# Meant to match only /etc/passwd. files,
# but also allows reading /etc/passwd itself
node --permission --allow-fs-read=/etc/passwd.* app.js

The fix tightens how wildcard patterns are interpreted for --allow-fs-read and --allow-fs-write. Teams relying on this model to sandbox processes should re-check their existing rules after upgrading.

Nine of the sixteen vulnerabilities fixed carry the highest severity rating Node.js assigns outside of a critical flaw, an unusually large share for a single security release.

#Prioritizing the upgrade by actual exposure

Not every fix carries the same weight depending on the architecture in place. The HTTP/2 issues matter most for servers that accept that protocol from untrusted clients. The respondWithFile() flaws only affect apps that serve files that way. The zlib issue only triggers if deflate.params() is called mid-stream. The Node.js team recommends moving to 22.23.5, 24.22.3 or 26.13.1 depending on the line in use, then auditing the llhttp and undici dependencies, also updated in this batch.

#Key takeaways

Sixteen vulnerabilities are fixed across Node.js 22.x, 24.x and 26.x, nine of them high severity and concentrated in HTTP/2 and TLS. Upgrading to 22.23.5, 24.22.3 or 26.13.1 should be a priority for any service exposed to unauthenticated clients, and teams using the permission model should re-validate their file-filtering rules.

To go further: the full breakdown of all sixteen vulnerabilities is published on Node.js’s official security blog.