The Node.js project shipped its November 2026 security release on November 11, fixing 16 vulnerabilities across the 22.x, 24.x, and 26.x lines. Seven are rated high severity. The most serious lets an unauthenticated client trigger a use-after-free during a TLS write and read back heap memory belonging to other connections, including TLS private keys. Patched versions are v22.23.5, v24.22.3, and v26.13.1, and every active release line is affected by at least one of the high-severity bugs.
A TLS Re-Entrancy Bug That Can Leak Private Keys to Any Visitor
The headline issue, CVE-2026-123864, sits in how Node.js handles a zero-length TLS write. When a handler calls res.flushHeaders() before the request body finishes and later calls res.end() with a non-empty chunk, a write of zero bytes re-enters llhttp_execute() while the HTTP parser is still mid-body. That re-entrancy causes a use-after-free, and the server ends up copying freed or unrelated heap memory, potentially including another connection’s TLS private key or request data, into the response body it sends back.
It requires no authentication and no unusual client behavior beyond an ordinary request. Cleartext node:http servers are not affected, since the bug lives in the TLS write path, but anything terminating TLS directly in Node.js on 22.x, 24.x, or 26.x should treat this as the priority patch in the batch.
Six More High-Severity Bugs, Mostly in HTTP/2
The rest of the high-severity list leans heavily on HTTP/2 and TLS edge cases:
- CVE-2026-123863: an unauthenticated client can crash an HTTP/2 server by arranging for a stream to outlive its session, tripping an assertion during teardown.
- CVE-2026-123865: a peer can trigger a protocol error during HTTP/2 shutdown and leave the session dangling forever, slowly exhausting memory and file descriptors.
- CVE-2026-123866: tearing down a backpressured HTTP/2 stream can send a freed response buffer, meaning another connection’s data, to the peer instead of the intended response.
- CVE-2026-126051: TLS servers using
SNICallback,OCSPRequest,newSession,resumeSession, orserver.addContext()can be crashed by a client that closes the connection at the wrong moment during handshake. - CVE-2026-123872: a client can renegotiate a TLS 1.2 connection under a different hostname and carry its authentication to a host with a stricter client-certificate policy, bypassing per-host mTLS rules.
- CVE-2026-123874: serving files with
respondWithFile()orrespondWithFD()opens a use-after-free if the client resets the stream mid-write.
The remaining eight issues are rated medium or low. They cover an HTTP/2 heap-buffer overflow in Alt-Svc handling, two more mTLS and TLS-session bypasses, an accounting gap that lets maxSessionMemory be exceeded, proxy credentials leaking into error messages, a crash in file-serving cancellation, and two Permission Model bypasses in fs.watch and wildcard filesystem grants. All 16 are detailed with CVE numbers in Node.js’s own advisory.
What This Node.js Security Release Means for Your Server
Upgrade to v22.23.5, v24.22.3, or v26.13.1 as soon as a deploy window allows, particularly if the application terminates TLS directly, runs an HTTP/2 server, or uses mutual TLS with per-host client certificate policies. End-of-life Node.js versions are affected by the same bugs and will not get a fix, which is as good a reason as any to finally move off them.
This is Node.js’s second security release in three weeks, following October’s fix for a critical RCE in the Brotli decoder, and it lands the same week as a separate Next.js security release. Teams running custom Node.js APIs or TLS-terminating services that haven’t had their HTTP/2 and TLS configuration reviewed in a while might be due for one. ConicPlex’s Web Application Development team audits exactly this kind of server-side exposure as part of ongoing backend work for clients.
