Node.js Patches Fourteen Security Flaws Across Its Three LTS Lines

The Node.js project shipped patched releases on Wednesday, November 11, 2026, for its three actively maintained lines: 22.x, 24.x, and 26.x. The batch closes fourteen vulnerabilities, seven of them rated high severity, and mainly affects HTTP/2 and TLS servers exposed to untrusted clients. A server memory leak exposing private keys is among the most serious cases.

#Seven High-Severity Flaws, From a TLS Key Leak to an HTTP/2 Denial of Service

The patched releases are 22.23.5, 24.22.3, and 26.13.1. The most concerning flaw, CVE-2026-123864, stems from a re-entrancy issue in TLSWrap::DoWrite(): it can leak server memory, including TLS private keys, straight into an HTTP response body. Plaintext node:http traffic is unaffected; only encrypted connections are at risk.

Several other high-severity flaws hit the HTTP/2 stack: an unauthenticated connection abort via a failed assertion in ~Http2Session(), sessions never cleaned up after a protocol error during shutdown, and a use-after-free during stream teardown. A further one, CVE-2026-123872, lets a client renegotiate a TLS 1.2 session to swap the server name and bypass client-certificate authentication.

#Medium and Low-Severity Issues Worth a Code Review Too

The medium-severity batch touches the permission model: wildcard --allow-fs-read and --allow-fs-write rules over-grant access, with a rule like /etc/passwd.* ending up allowing /etc/passwd. Another entry hits https.Agent, where TLS session reuse across two different CA policies bypasses certificate validation, alongside proxy credentials leaking into an error message and a recursive fs.watch that exposes, on macOS and Windows, filenames that should stay hidden.

A TLS 1.2 renegotiation that swaps the server name mid-handshake is enough to bypass a properly configured client-certificate check.

#Patch Now — No Documented Workaround

None of the release notes document a workaround for unpatched editions: upgrading remains the only remediation. Checking the current version takes one line, followed by installing the patched release for the line in use.

node -v
# depending on the line in use
nvm install 22.23.5
nvm install 24.22.3
nvm install 26.13.1

Internal dependencies llhttp, undici, and sqlite were also bumped in this batch, with no change on the V8 side. Lines that already reached end-of-life receive no fix at all.

#A Patch Cadence That Matters Across the Backend Ecosystem

Node.js’s release calendar, whose shift to an annual cycle was confirmed in early November with the 27 line now in alpha, changes nothing about how security emergencies are handled on existing LTS lines. Teams orchestrating these upgrades in production benefit from the same rigor on transport encryption elsewhere, whether on an application server or, in a very different context, in SMTP transport encryption monitoring: a poorly validated certificate has the same consequences regardless of the protocol.

#Key Takeaways

Fourteen flaws fixed in a single release, seven of them high severity and concentrated on HTTP/2 and TLS, justify a quick upgrade across Node.js’s three LTS lines. Teams exposing HTTP/2 or TLS servers to outside clients should treat this patch as a priority; everyone else should still review their permission-model rules before the next deployment cycle.

Further reading: the full release notes are published by the Node.js project at nodejs.org.