Skip to main content
cve.nowby Sazabi
Menu
Early warnings

Early warning

Node.js fixes 16 vulnerabilities, including HTTP/2 crash and memory-leak flaws

Node.js released fixed versions 22.23.5, 24.22.3 and 26.13.1 for 16 vulnerabilities, seven rated high, including HTTP/2 crash and memory-disclosure flaws.

SZB-0ddeb66320Pending CVEConfirmed

Written by a model from the sources below. Verify against them.

Sources8Confirmed
Kind
Pending CVE
Vendor
Node.js
Product
Node.js
Status
Confirmed
First seen
Confirmed

Summary

Node.js released fixed versions 22.23.5, 24.22.3 and 26.13.1 for 16 vulnerabilities, seven rated high, including HTTP/2 crash and memory-disclosure flaws. The project's advisory reports no attacks using the flaws, and it says the HTTPS flaw CVE-2026-123864 can expose TLS private keys and other users' requests.

What to do

  • Upgrade Node.js to 22.23.5, 24.22.3 or 26.13.1, whichever matches your release line.

  • Move end-of-life lines such as 20.x and 25.x to a supported release, since the project will not fix them.

  • If your HTTPS server met the conditions for CVE-2026-123864, consider rotating TLS keys and other secrets after updating, as the advisory does not say whether t

  • Where an immediate upgrade is not possible, note that the advisory lists no workaround.

Timeline

  1. Made public by oss-security
  2. First seen by cve.now1 day
  3. Record last updated
  4. Confirmed as CVE-2026-123863

Evidence 8

  1. Social
    oss-security
    “Re: Node.js security release pre-alert”
  2. Social
    Mastodon
    “Node.js fixes 17 bugs, including Node.js HTTP/2 vulnerabilities and a TLS heap leak (CVE-2026-123864).”
  3. Social
    Mastodon
    “A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process.”
    +10 more: Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon
  4. Social
    Mastodon
    “A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads.”
  5. Social
    Mastodon
    “Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages.”
Show all 8 sourcesShow fewer sources
  1. Social
    Mastodon
    “An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed.”
  2. Social
    Mastodon
    “A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read.”
  3. Press
    The Hacker News
    “A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-0ddeb66320

Has Node.js confirmed it?

Yes. Confirmed as CVE-2026-123863.Source: oss-security, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, The Hacker News

What should Node.js users do?

Upgrade Node.js to 22.23.5, 24.22.3 or 26.13.1, whichever matches your release line. Move end-of-life lines such as 20.x and 25.x to a supported release, since the project will not fix them. If your HTTPS server met the conditions for CVE-2026-123864, consider rotating TLS keys and other secrets after updating, as the advisory does not say whether t. Where an immediate upgrade is not possible, note that the advisory lists no workaround.

Does it have a CVE?

Yes. It is tracked as CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123872, CVE-2026-123874, CVE-2026-123875 and CVE-2026-126051.Source: CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123872, CVE-2026-123874, CVE-2026-123875, CVE-2026-126051

Sources

Tracked as