{
  "id": "nodejs-nov-2026",
  "url": "https://ohshit.app/incidents/nodejs-nov-2026/",
  "title": "Node.js ships security updates including HTTPS heap disclosure and HTTP/2 crashes",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-11",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Node.js",
    "HTTP/2",
    "TLS"
  ],
  "ecosystems": [],
  "summary": "Node.js 22.23.5, 24.22.3 and 26.13.1 fix November HTTP/2, HTTPS, TLS, proxy and Permission Model flaws. The HTTPS disclosure needs particular response handling and a way to retrieve body data. Several HTTP/2 failures are remotely reachable.",
  "splash": "Node.js 22.x, 24.x and 26.x below the fixed builds. Exposure depends on the HTTP/2, TLS, proxy or Permission Model feature in use.",
  "wipe": "Upgrade to 22.23.5, 24.22.3 or 26.13.1. Rebuild and restart workloads, then verify the actual running versions.",
  "in_the_wild": "unknown",
  "source_exception": null,
  "cves": [
    {
      "id": "CVE-2026-123863",
      "name": "HTTP/2 session teardown abort",
      "description": "On 24.x and 26.x, early responses can leave allocated headers during teardown and terminate the process."
    },
    {
      "id": "CVE-2026-123864",
      "name": "HTTPS parser re-entry leaks heap data",
      "description": "On 22.x, 24.x and 26.x, early header flushing and later non-empty response completion can lead to a heap read. An echo or storage route is needed to retrieve the data."
    },
    {
      "id": "CVE-2026-123865",
      "name": "HTTP/2 shutdown leaves sessions open",
      "description": "On all three lines, a protocol error during shutdown can strand memory and file descriptors."
    },
    {
      "id": "CVE-2026-123866",
      "name": "HTTP/2 teardown leaks response buffers",
      "description": "On all three lines, a backpressured write followed by teardown can send freed memory. Purely remote teardown applies to 24.22.0 and 26.9.0 onward before the fixes."
    },
    {
      "id": "CVE-2026-126051",
      "name": "TLS deferred handshake callback crash",
      "description": "On 24.x and 26.x, selected server handshake hooks or addContext can leave a deferred callback using a destroyed socket."
    },
    {
      "id": "CVE-2026-123872",
      "name": "TLS 1.2 renegotiation bypasses per-host mTLS",
      "description": "On all three lines, a client authenticated for one hostname can carry that authorization to a stricter hostname on a server with different client-certificate policies."
    },
    {
      "id": "CVE-2026-123874",
      "name": "HTTP/2 file response use-after-free",
      "description": "On 24.x and 26.x, a reset while respondWithFile or respondWithFD has a pending write can leave a freed stream reference."
    },
    {
      "id": "CVE-2026-123828",
      "name": "HTTP/2 Alt-Svc origin overflow",
      "description": "On 24.x and 26.x, passing a long attacker-controlled origin to session.altsvc can write one byte beyond a heap buffer."
    },
    {
      "id": "CVE-2026-123867",
      "name": "CA-only SNI contexts fall back to default CA",
      "description": "On all three lines, an SNI context supplying only a client CA can retain the default CA, accepting a certificate barred by the per-host policy."
    },
    {
      "id": "CVE-2026-123868",
      "name": "Undrained HTTP/2 streams evade session memory accounting",
      "description": "On 24.x and 26.x, queued inbound buffers can grow outside the maxSessionMemory budget."
    },
    {
      "id": "CVE-2026-123871",
      "name": "Invalid proxy configuration logs credentials",
      "description": "On all three lines, selected ERR_PROXY_INVALID_CONFIG paths can emit raw proxy URLs with embedded credentials."
    },
    {
      "id": "CVE-2026-123877",
      "name": "HTTPS Agent resumes sessions across CA policies",
      "description": "On all three lines, requests omitting ca and passing ca: [] can share a cache key, letting TLS 1.3 resume a previously authorized session."
    },
    {
      "id": "CVE-2026-123875",
      "name": "Cancelling an HTTP/2 file response can crash the server",
      "description": "On all three lines, cancelling respondWithFile or respondWithFD can trigger a null pointer dereference."
    },
    {
      "id": "CVE-2026-123829",
      "name": "Recursive file watching exposes denied names",
      "description": "On macOS and Windows on all three lines, a recursive watcher with a limited read grant can reveal descendant names and timing metadata."
    },
    {
      "id": "CVE-2026-123862",
      "name": "Destroying a zlib stream can abort the process",
      "description": "On all three lines, peer disconnect can crash applications that call deflate.params while streaming."
    }
  ],
  "fixed": [
    {
      "product": "Node.js 22.x",
      "version": "22.23.5"
    },
    {
      "product": "Node.js 24.x",
      "version": "24.22.3"
    },
    {
      "product": "Node.js 26.x",
      "version": "26.13.1"
    }
  ],
  "checklist": [
    {
      "title": "Patch the Node.js runtime wherever it runs",
      "hint": "Run node --version on hosts, inside deployed containers and on CI runners. Update the runtime or base image, rebuild from trusted inputs, restart services and recheck the runtime in each deployed workload. Move unsupported versions to a supported line."
    },
    {
      "title": "Identify the exposed application paths",
      "hint": "Review HTTP/2 endpoints, especially file-serving and stream-teardown behavior. For HTTPS, look for early res.flushHeaders(), later non-empty res.end(), and request-body echo or storage. Review per-host TLS certificate policy, shared HTTPS Agents and proxy error logging."
    },
    {
      "title": "Investigate suspicious crashes or possible secret exposure",
      "hint": "Preserve application, reverse-proxy and process logs. Look for repeated HTTP/2 crashes, CLOSE_WAIT accumulation, unexpected per-host authorization and proxy errors with credentials. If investigation indicates exposure, revoke affected secrets at the issuer and replace them from a clean environment."
    }
  ],
  "sources": [
    {
      "name": "Node.js November security release bulletin",
      "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
      "says": "Lists all 16 CVEs, feature and branch prerequisites, dependency updates and all three fixed releases.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The Node.js bulletin reports vulnerabilities and fixes, with no confirmed exploitation.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 11, 2026",
      "title": "Node.js publishes the November security releases",
      "body": "The bulletin lists 16 Node.js CVEs, including one previously disclosed in October, and dependency updates for the active lines."
    }
  ],
  "body_markdown": "This is a separate batch from the [October releases](/incidents/nodejs-oct-2026/). The bulletin lists seven high, six medium and three low severity Node.js flaws. The existing October entry tracks the previously disclosed wildcard permission flaw. The November bulletin also lists llhttp, undici and sqlite updates on specified lines. CVE-2026-123864 requires a Node.js HTTPS handler that flushes response headers before the request body ends and later ends the response with a non-empty chunk. A route that reflects or stores request bodies can expose the resulting memory. Cleartext node:http is outside this path. Other bugs affect HTTP/2 over TLS or cleartext, TLS handshakes, mTLS policy or local feature use. Use the bulletin’s per-CVE applicability for prioritization and patch all supported lines."
}