HTTP/2 session teardown abort
On 24.x and 26.x, early responses can leave allocated headers during teardown and terminate the process.
Node.js ships security updates including HTTPS heap disclosure and HTTP/2 crashes
Node.js 22.23.5, 24.22.3 and 26.13.1 fix November HTTP/2, HTTPS, TLS, proxy and Permission Model flaws. The HTTPS disclosure needs particular response handling and a way to retrieve body data. Several HTTP/2 failures are remotely reachable.
- Disclosed
- Nov 11, 2026
- Public disclosure date
- Severity
- Sharted
- 15 CVEs tracked here
- Splash zone
- Node.js 22.x, 24.x and 26.x below the fixed builds. Exposure depends on the HTTP/2, TLS, proxy or Permission Model feature in use.
- Node.js · HTTP/2 · TLS
- In the wild
- Unknown
- The Node.js bulletin reports vulnerabilities and fixes, with no confirmed exploitation.
What happened
This is a separate batch from the October releases. The bulletin lists seven high, six medium and three low severity Node.js flaws. The existing October entry tracks the previously disclosed wildcard permission flaw. The November bulletin also lists llhttp, undici and sqlite updates on specified lines. CVE-2026-123864 requires a Node.js HTTPS handler that flushes response headers before the request body ends and later ends the response with a non-empty chunk. A route that reflects or stores request bodies can expose the resulting memory. Cleartext node:http is outside this path. Other bugs affect HTTP/2 over TLS or cleartext, TLS handshakes, mTLS policy or local feature use. Use the bulletin’s per-CVE applicability for prioritization and patch all supported lines.
What’s in the bowl
HTTPS parser re-entry leaks heap data
On 22.x, 24.x and 26.x, early header flushing and later non-empty response completion can lead to a heap read. An echo or storage route is needed to retrieve the data.
HTTP/2 shutdown leaves sessions open
On all three lines, a protocol error during shutdown can strand memory and file descriptors.
HTTP/2 teardown leaks response buffers
On all three lines, a backpressured write followed by teardown can send freed memory. Purely remote teardown applies to 24.22.0 and 26.9.0 onward before the fixes.
TLS deferred handshake callback crash
On 24.x and 26.x, selected server handshake hooks or addContext can leave a deferred callback using a destroyed socket.
TLS 1.2 renegotiation bypasses per-host mTLS
On all three lines, a client authenticated for one hostname can carry that authorization to a stricter hostname on a server with different client-certificate policies.
HTTP/2 file response use-after-free
On 24.x and 26.x, a reset while respondWithFile or respondWithFD has a pending write can leave a freed stream reference.
HTTP/2 Alt-Svc origin overflow
On 24.x and 26.x, passing a long attacker-controlled origin to session.altsvc can write one byte beyond a heap buffer.
CA-only SNI contexts fall back to default CA
On all three lines, an SNI context supplying only a client CA can retain the default CA, accepting a certificate barred by the per-host policy.
Undrained HTTP/2 streams evade session memory accounting
On 24.x and 26.x, queued inbound buffers can grow outside the maxSessionMemory budget.
Invalid proxy configuration logs credentials
On all three lines, selected ERR_PROXY_INVALID_CONFIG paths can emit raw proxy URLs with embedded credentials.
HTTPS Agent resumes sessions across CA policies
On all three lines, requests omitting ca and passing ca: [] can share a cache key, letting TLS 1.3 resume a previously authorized session.
Cancelling an HTTP/2 file response can crash the server
On all three lines, cancelling respondWithFile or respondWithFD can trigger a null pointer dereference.
Recursive file watching exposes denied names
On macOS and Windows on all three lines, a recursive watcher with a limited read grant can reveal descendant names and timing metadata.
Destroying a zlib stream can abort the process
On all three lines, peer disconnect can crash applications that call deflate.params while streaming.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Node.js 22.x | 22.23.5 | |
| Node.js 24.x | 24.22.3 | |
| Node.js 26.x | 26.13.1 |
Crime-scene timeline
Nov 11, 2026
Node.js publishes the November security releases
The bulletin lists 16 Node.js CVEs, including one previously disclosed in October, and dependency updates for the active lines.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Node.js November security release bulletinPrimaryLists all 16 CVEs, feature and branch prerequisites, dependency updates and all three fixed releases.