The Node.js team released security updates for its three supported lines on November 11: v22.23.5, v24.22.3 and v26.13.1. They close 16 flaws, seven of them rated high. Most sit in the HTTP/2 and TLS code, which means they matter for servers that face the internet directly, and many of them need no credentials to exploit.
The most worrying one is CVE-2026-123864. Under certain conditions an HTTPS server copies part of its own memory into a request body. According to GBHackers, this can leak data from other connections, including TLS private keys. Plain, unencrypted node:http servers are not affected.
The other serious flaws let an attacker crash the server, slowly exhaust its memory or get around authentication. CVE-2026-123872, for example, allows a client to change the servername during TLS 1.2 renegotiation and slip past client certificate checks. CVE-2026-123875 is simpler still: a handful of cancelled downloads is enough to crash an HTTP/2 server that serves files with respondWithFile().
The 24.x and 26.x lines are affected by all 16 issues, 22.x by 11 of them. End-of-life versions such as Node.js 20 will not get a fix, but as the Node.js team notes, they are always affected too.
What to do? Update Node.js to the latest release of your line and restart your services, because the fix does not take effect while the old process keeps running. If your apps run in Docker, update the base image and rebuild the containers. If you cannot update right away, temporarily limit how exposed your HTTP/2 and file-serving endpoints are to the internet.
