# SZB-0ddeb66320: Node.js fixes 16 vulnerabilities, including HTTP/2 crash and memory-leak flaws

Node.js released fixed versions 22.23.5, 24.22.3 and 26.13.1 for 16 vulnerabilities, seven rated high, including HTTP/2 crash and memory-disclosure flaws.

- Type: Early warning
- Kind: Pending CVE
- Vendor: Node.js
- Product: Node.js
- Status: Confirmed
- Sources: 8 distinct
- First seen: 2026-11-11 17:44 UTC
- Confirmed: 2026-11-12 09:10 UTC

Written by a model from the sources below. Verify against them.

## Summary

Node.js released fixed versions 22.23.5, 24.22.3 and 26.13.1 for 16 vulnerabilities, seven rated high, including HTTP/2 crash and memory-disclosure flaws. The project's advisory reports no attacks using the flaws, and it says the HTTPS flaw CVE-2026-123864 can expose TLS private keys and other users' requests.

## What to do

- Upgrade Node.js to 22.23.5, 24.22.3 or 26.13.1, whichever matches your release line.
- Move end-of-life lines such as 20.x and 25.x to a supported release, since the project will not fix them.
- If your HTTPS server met the conditions for CVE-2026-123864, consider rotating TLS keys and other secrets after updating, as the advisory does not say whether t
- Where an immediate upgrade is not possible, note that the advisory lists no workaround.

## Timeline

- 2026-11-11 17:32 UTC: Made public by oss-security
- 2026-11-11 17:44 UTC: First seen by cve.now
- 2026-11-12 09:10 UTC: Record last updated
- 2026-11-12 09:10 UTC: Confirmed as CVE-2026-123863

## Evidence (8 sources)

- 2026-11-11 · Social · [oss-security](https://seclists.org/oss-sec/2026/q4/674): “Re: Node.js security release pre-alert”
- 2026-11-11 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117599042422755255): “Node.js fixes 17 bugs, including Node.js HTTP/2 vulnerabilities and a TLS heap leak (CVE-2026-123864).”
- 2026-11-11 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117599349538392203): “A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process.” (+10 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117599349756728409), [Mastodon](https://mastodon.social/@EUVD_Bot/117599349834023900), [Mastodon](https://mastodon.social/@EUVD_Bot/117599353461403126), [Mastodon](https://mastodon.social/@EUVD_Bot/117599353702482167), [Mastodon](https://mastodon.social/@EUVD_Bot/117599353761630056), [Mastodon](https://mastodon.social/@EUVD_Bot/117599357286367407), [Mastodon](https://mastodon.social/@EUVD_Bot/117599357370305247), [Mastodon](https://mastodon.social/@EUVD_Bot/117599357455658991), [Mastodon](https://mastodon.social/@EUVD_Bot/117599357512833565), [Mastodon](https://mastodon.social/@EUVD_Bot/117600081037428233))
- 2026-11-11 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117599349587261671): “A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads.”
- 2026-11-11 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117599353610659456): “Node.js discloses proxy credentials in ERR\_PROXY\_INVALID\_CONFIG error messages.”
- 2026-11-11 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117599357616208592): “An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed.”
- 2026-11-11 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117599365595830313): “A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read.”
- 2026-11-12 · Press · [The Hacker News](https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html): “A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-0ddeb66320&body=https%3A%2F%2Fcve.now%2FSZB-0ddeb66320%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-0ddeb66320

### Has Node.js confirmed it?

Yes. Confirmed as CVE-2026-123863.

Source: https://seclists.org/oss-sec/2026/q4/674, https://infosec.exchange/@DailyCyberSecurity/117599042422755255, https://mastodon.social/@EUVD_Bot/117599349538392203, https://mastodon.social/@EUVD_Bot/117599349587261671, https://mastodon.social/@EUVD_Bot/117599353610659456, https://mastodon.social/@EUVD_Bot/117599357616208592, https://mastodon.social/@EUVD_Bot/117599365595830313, https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html

### What should Node.js users do?

Upgrade Node.js to 22.23.5, 24.22.3 or 26.13.1, whichever matches your release line. Move end-of-life lines such as 20.x and 25.x to a supported release, since the project will not fix them. If your HTTPS server met the conditions for CVE-2026-123864, consider rotating TLS keys and other secrets after updating, as the advisory does not say whether t. Where an immediate upgrade is not possible, note that the advisory lists no workaround.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123872, CVE-2026-123874, CVE-2026-123875 and CVE-2026-126051.

Source: https://cve.now/CVE-2026-123863, https://cve.now/CVE-2026-123864, https://cve.now/CVE-2026-123865, https://cve.now/CVE-2026-123866, https://cve.now/CVE-2026-123872, https://cve.now/CVE-2026-123874, https://cve.now/CVE-2026-123875, https://cve.now/CVE-2026-126051

## Tracked as

- [CVE-2026-123863](https://cve.now/CVE-2026-123863.md)
- [CVE-2026-123864](https://cve.now/CVE-2026-123864.md)
- [CVE-2026-123865](https://cve.now/CVE-2026-123865.md)
- [CVE-2026-123866](https://cve.now/CVE-2026-123866.md)
- [CVE-2026-123872](https://cve.now/CVE-2026-123872.md)
- [CVE-2026-123874](https://cve.now/CVE-2026-123874.md)
- [CVE-2026-123875](https://cve.now/CVE-2026-123875.md)
- [CVE-2026-126051](https://cve.now/CVE-2026-126051.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-0ddeb66320
Site guide for agents: https://cve.now/llms.txt