Node.js published its 11 November 2026 security releases for the 26.x, 24.x and 22.x lines. The post states: "Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues," and lists the downloads Node.js v22.23.5, Node.js v24.22.3 and Node.js v26.13.1. These releases are out: their release pages and nodejs.org/dist directories were live at our 19:25 Asia/Jerusalem UTC+2 check on 11 November. A "Release timing" line on the post still says releases "will be available on, or shortly after, Wednesday, November 11, 2026"; Node.js gives no clock time.
Node.js states: "The highest severity issue fixed in this release is HIGH." This post leads with CVE-2026-123864 and CVE-2026-123863, both of which Node.js rates (high). For CVE-2026-123864, Node.js says: "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests." For CVE-2026-123863, Node.js says a reachable assertion in HTTP/2 session teardown "lets any unauthenticated client abort the server, over both TLS and cleartext."
The Node.js post does not discuss exploitation, and this post makes no exploitation claim. CVE-2026-123864 and CVE-2026-123863 are not in CISA KEV as of catalogVersion 2026.11.10, checked 12 November 2026 at 07:58 Asia/Jerusalem UTC+2.
Technical Information
CVE-2026-123864 (HTTPS heap disclosure), rated (high) by Node.js. Node.js titles it "HTTPS: a zero-length TLS write re-enters llhttp_execute(), and the server copies its own heap into the request body." It describes a path through TLSWrap::DoWrite() and ClearOut() that re-enters the HTTP parser, "causing a use-after-free and an out-of-bounds heap read." It adds: "The server then copies that freed or unrelated heap memory into the response for the request body."
Node.js states the preconditions: "Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected." The impact line reads: "This vulnerability affects all users in active release lines: 22.x, 24.x, 26.x." This post does not treat a private-key leak as confirmed on any deployment.
CVE-2026-123863 (HTTP/2 abort), rated (high) by Node.js. Node.js titles it "HTTP/2: remote abort, CHECK_EQ(current_nghttp2_memory_, 0) in ~Http2Session()." It says: "The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical," and that it is "a variant of CVE-2024-27983 that the earlier fix did not cover." The impact line reads: "This vulnerability affects all users in active release lines: 24.x, 26.x."
Other issues in the same release. The security post also lists further HTTP/2, TLS and Permission Model issues, each with its own Node.js rating and impact line, plus dependency updates "to address public vulnerabilities": llhttp on 22.x, 24.x, 26.x; undici on 24.x, 26.x; and sqlite on 22.x, 24.x. Details are on the official post. CVE-2026-106071, a Permission Model issue the post lists as (low), is not new this month: its CVE record was published on 23 October 2026 and references the October security releases.
Release-note differences. This post follows the security post. The v22.23.5 changelog also lists a CVE-2026-123863 fix, although the security post's impact line for that CVE names only 24.x and 26.x.
CVE.org and NVD. CVE.org published records for CVE-2026-123864 on 11 November 2026 at 18:17 UTC (20:17 Asia/Jerusalem UTC+2) and for CVE-2026-123863 at 18:16 UTC (20:16 Asia/Jerusalem UTC+2). The assigner is the OpenJS Foundation CNA (openjs). The CNA gives CVE-2026-123864 a CVSS 3.0 base score of 8.1 High (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H) and CVE-2026-123863 a CVSS 3.0 base score of 8.2 High (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). At our 07:58 Asia/Jerusalem UTC+2 check on 12 November, NVD listed both as Received, carried those CNA scores as Secondary, and had no NVD primary score. This post's rating remains Node.js's own (high).
Affected and Fixed Releases
From the Node.js security-release post:
| Release line | Download listed by Node.js |
|---|---|
| 22.x | Node.js v22.23.5 |
| 24.x | Node.js v24.22.3 |
| 26.x | Node.js v26.13.1 |
| CVE | Node.js rating | OpenJS CNA CVSS 3.0 | Impact line on the security-release post |
|---|---|---|---|
| CVE-2026-123864 | (high) | 8.1 High | "This vulnerability affects all users in active release lines: 22.x, 24.x, 26.x" |
| CVE-2026-123863 | (high) | 8.2 High | "This vulnerability affects all users in active release lines: 24.x, 26.x" |
Node.js adds: "It's important to note that End-of-Life versions are always affected when a security release occurs," and asks users to run an up-to-date version per its Release Schedule.
Exploitation Status
The 11 November Node.js security-release post does not discuss exploitation, known attacks or public proof-of-concept code. CVE-2026-123864 and CVE-2026-123863 were not in CISA KEV at the 07:58 Asia/Jerusalem UTC+2 check on 12 November (catalogVersion 2026.11.10, dateReleased 21:03 Asia/Jerusalem UTC+2 on 10 November). This post makes no exploitation claim.
Workaround and Mitigation
The Node.js post lists no workaround. Its remediation is the listed releases: Node.js v22.23.5, v24.22.3 and v26.13.1. Services on End-of-Life lines should move to a supported release, as Node.js advises.
Indicators of Compromise
Node.js has published no indicators of compromise or detection guidance for these issues, and this post does not supply any.
What to Ask Your Vendors Today
Many SaaS providers, MSPs and software vendors run Node.js in production behind HTTPS and HTTP/2 endpoints that face the internet, including services that handle your data. Ask vendors that run Node.js for you, in writing:
- Whether their internet-facing HTTPS and HTTP/2 services are on the releases Node.js lists (v22.23.5, v24.22.3 or v26.13.1, as applicable), and when each was updated.
- Whether any HTTPS service ran an affected release with the handler pattern Node.js describes for CVE-2026-123864 (
res.flushHeaders()before the body ends, thenres.end()with a non-empty chunk, plus a route that echoes or stores request bodies), and, if so, whether TLS private keys and related credentials were rotated.
If you run Node.js services yourself, apply the official releases first, then check the same points against your own inventory.
If your team needs help reviewing which suppliers run Node.js HTTPS or HTTP/2 services and whether those fleets are on the 11 November releases, Talk to an expert.
Sources
- Wednesday, November 11, 2026 Security Releases, Node.js. Primary source for ratings, impact lines, the TLS private-key wording and preconditions, and the listed downloads. Rechecked 11 November 2026 at 19:25 Asia/Jerusalem UTC+2.
- Node.js 22.23.5, 24.22.3 and 26.13.1 release pages, each marked "This is a security release," with distribution directories v22.23.5, v24.22.3 and v26.13.1 live at the same check.
- CVE-2026-123864 and CVE-2026-123863 on CVE.org, published 11 November 2026 at 18:17 UTC and 18:16 UTC respectively by the OpenJS Foundation CNA (openjs), which assigns CVSS 3.0 base scores of 8.1 High and 8.2 High. NVD for CVE-2026-123864 and NVD for CVE-2026-123863 listed both as Received, with those CNA scores marked Secondary and no NVD primary score, at our 07:58 Asia/Jerusalem UTC+2 check on 12 November 2026.
- CVE-2026-106071 on CVE.org, published 23 October 2026.
- CISA catalog JSON feed — catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29Z; CVE-2026-123864 and CVE-2026-123863 are not in CISA KEV as of 12 November 2026 at 07:58 Asia/Jerusalem UTC+2.
