A Node.js security release fixes 16 flaws in the 22, 24 and 26 lines. The most serious could let a stranger on the internet pull TLS private keys and other people’s requests out of a server’s memory. If you run a Node server, the builds to move to are 22.23.5, 24.22.3 or 26.13.1.
The project grades seven of them high, six medium and three low. Seven concern HTTP/2 handling, where a client with no login can crash a server, leak its memory or use up its resources, and three weaken TLS checks on servers that rely on client certificates.
The Node.js project’s advisory singles out CVE-2026-123864. When a zero-length TLS write is issued from inside the HTTP parser, the server can end up copying freed or unrelated heap memory into a response, including memory that belongs to other connections. All three active lines are affected. It is not trivial to trigger. The app must call res.flushHeaders() early, before it has received the whole upload, and finish with res.end() carrying data; reading what leaks also takes a route that sends an upload back or stores it. Plain-text node:http is not affected.
The HTTP/2 group is the broadest. Per the advisory, a default HTTP/2 server can be aborted by a single unauthenticated client when its handler replies before the request body has finished, a pattern the advisory calls typical. Another bug leaves half-closed sessions in memory for good once a protocol error arrives during shutdown, so a patient attacker can drain a server’s memory and file descriptors at almost no cost. A third can hand the other side leftover response memory when a stream is cancelled mid-write.
The certificate bugs matter for companies that run mutual TLS. One lets a visitor who passed the check for a low-security site name switch to a stricter one halfway through the handshake and keep the access. In another, a cached TLS session from a looser CA policy is reused by a request that set a stricter one, so the second connection is reported as authorised when a fresh one would be refused.
Three of the high-rated flaws, including the private-key leak, were reported by Chris Rohlf together with Claude and Anthropic Research, the advisory says. A medium-rated one stops Node.js printing proxy usernames and passwords into error messages, where they could end up in container logs or crash reports.
Node.js was in the news for patches last month too: PKCERT urged Pakistani agencies to patch 10 other Node.js flaws at the end of October. Node.js also says that retired versions are always vulnerable when a security release ships, so a server on one has no patched build and has to move to a supported line.
