Node.js Patches HTTP/2 Flaws That Crash Servers and Leak Data

The Node.js project has released security updates addressing 16 vulnerabilities across its supported release lines, including seven rated high severity. The most critical defects affect the runtime's built-in HTTP/2, HTTPS, and TLS server implementations, allowing unauthenticated remote clients to crash servers or extract sensitive memory, including TLS private keys and other users' requests. Fixed versions have been made available across all three supported branches: 22.23.5, 24.22.3, and 26.13.1. Organisations in Malaysia experiencing potential incidents can report them to Cyber999 operated by MyCERT.

Key Facts

How Do the HTTP/2 and HTTPS Flaws Expose Server Memory?

Unauthenticated clients can trigger memory disclosure across built-in HTTP/2 and HTTPS servers. In HTTPS implementations, premature header flushing enables an external client to read memory from other connections, potentially revealing TLS private keys and user requests. In HTTP/2 environments, server memory containing responses intended for other active connections can similarly be leaked.

Under CVE-2026-123864, memory disclosure occurs when an HTTPS handler calls res.flushHeaders() before the request body has fully arrived and subsequently invokes res.end() with data, provided the application has a route that stores or sends back request bodies. Plain HTTP servers built using node:http are unaffected. Under CVE-2026-123866, clients alone can trigger memory leakage on Node.js 24.22.0 and 26.9.0 onward, whereas on line 22.x and earlier 24.x and 26.x builds, triggering requires the server to close a stream partway through a response, such as after an idle timeout.

The advisory does not state whether operators of servers meeting the conditions for CVE-2026-123864 should replace their TLS keys or other secrets after updating.

How Can Remote Clients Trigger Denial-of-Service Crashes?

Unauthenticated clients can terminate Node.js servers remotely by exploiting several flaws in the runtime's core networking code. Flaw CVE-2026-123863 enables denial of service when a default HTTP/2 server responds before a request body arrives completely. Further crashes can occur via TLS context callbacks or by cancelling active file stream downloads.

The Node.js project notes that responding before the entire request body arrives is typical application behaviour, and CVE-2026-123863 functions over both TLS and cleartext connections on lines 24.x and 26.x. Additionally, CVE-2026-126051 permits remote crashes on 24.x and 26.x TLS servers using server.addContext() or hooks including SNICallback, OCSPRequest, newSession, or resumeSession. Across all three supported lines, CVE-2026-123875 allows clients cancelling downloads served with stream.respondWithFile() or stream.respondWithFD() to crash the server, while CVE-2026-123865 permits clients to force any default HTTP/2 server to hold memory and file descriptors permanently.

All identified crash flaws reside in Node.js core server code and affect deployments where a Node.js process accepts incoming connections directly.

Have Any of These Vulnerabilities Been Targeted in Attacks?

The Node.js project security advisory reports no known attacks exploiting any of the 16 vulnerabilities resolved in this release. The patched issues were identified through coordinated vulnerability research rather than discovered through malicious activity. Five vulnerabilities, including severe crash and data exposure bugs, were reported by Chris Rohlf collaborating with Claude and Anthropic Research.

Although no active exploits have been observed, the impact of these vulnerabilities remains elevated because seven are rated high severity and require no prior authentication. The security release provides official fixes exclusively for active release lines, leaving unsupported branches vulnerable without mitigation. The advisory lists no interim workarounds for administrators unable to deploy the newly released runtime packages immediately.

The official advisory confirms no in-the-wild attacks were reported for the 16 vulnerabilities at the time of publication.

What Should You Do?

• Upgrade Node.js 22.x environments to version 22.23.5.
• Upgrade Node.js 24.x environments to version 24.22.3.
• Upgrade Node.js 26.x environments to version 26.13.1.
• Decommission or upgrade end-of-life lines, such as 20.x and 25.x, which receive no patches and remain permanently affected.
• Apply the updates promptly, as the vendor advisory provides no workaround configurations for servers that cannot update immediately.
• Report any suspected security incidents involving Malaysian systems to Cyber999 via MyCERT.

Common Questions

Are plain HTTP servers using node:http affected by the HTTPS memory leak?

No, plain HTTP servers built with node:http are not affected by CVE-2026-123864. The memory exposure specifically requires an HTTPS handler that invokes res.flushHeaders() before the request body has fully arrived and later calls res.end() with data on routes processing bodies.

Are any temporary workarounds available if servers cannot update immediately?

The Node.js project lists no workarounds for servers that cannot update yet. Updating each affected branch to its designated fixed version represents the only remediation mechanism provided in the official advisory to protect vulnerable environments against potential exploitation.

Will unsupported versions like Node.js 20.x receive security patches?

End-of-life release lines such as 20.x and 25.x will not receive fixes in this release cycle. The Node.js project states that end-of-life versions are always affected, necessitating an upgrade to supported, maintained release versions to resolve these vulnerabilities.

Sources and Methodology

This news dispatch is based solely on reporting published by The Hacker News on 12 November 2026. ROCKSTARmedia Infosec has not reviewed, verified, or consulted any external technical advisories, vendor documentation, or third-party reports for this summary.