Node.js fixes 17 vulnerabilities including high-risk HTTP/2 memory leaks and TLS certificate bypasses in releases 26.13.1, 24.22.3, 22.23.5

Entenda a falha

A vulnerabilidade

Node.js fixed 17 vulnerabilities, seven rated high, mostly in HTTP/2 and TLS. The worst, CVE-2026-123864, is a use-after-free and out-of-bounds read in the HTTPS parser path that can expose TLS private keys and other users' requests. It needs a handler that flushes headers early and later ends the response with data; cleartext node:http is not affected. Other CVEs include HTTP/2 stream and session teardown bugs (CVE-2026-123863, 123865, 123866, 123874, 123828, 123875, 123868) that let an unauthenticated client crash the server, leak memory or file descriptors, or receive freed memory. TLS bugs (CVE-2026-123872, 123867, 123877, 126051) allow client-certificate policy bypasses and TLS server crashes. Affected: 22.x before 22.23.5, 24.x before 24.22.3 and 26.x before 26.13.1; some bugs affect only 24.x and 26.x.

Como funciona

For CVE-2026-123864, a client sends requests over HTTPS and the server's HTTP parser hands body data to a callback. If a zero-length TLS write happens inside that callback, Node.js decrypts the next TLS record too early. That re-enters the parser while it is still working, which triggers a use-after-free and an out-of-bounds read, and the server copies freed or unrelated heap memory into the request body. In the HTTP/2 bugs, sessions or streams are closed while writes are still pending or while a stream outlives its session, so the code later touches memory that is gone or fails a memory check and aborts.

Por que é vulnerável

The articles describe the causes as lifecycle and state-handling errors: re-entrancy in the HTTP parser during TLS decryption, streams outliving their sessions, teardown during backpressured writes, and data queued on an undrained stream escaping the maxSessionMemory limit. In TLS, a servername change during TLS 1.2 renegotiation carries over the client's authentication to a host with a stricter policy, a CA-only SNI context falls back to the default client CA, and https.Agent reuses a TLS session across different CA policies. The fix, mostly written by Matteo Collina, is in the patched releases; the articles do not detail the code changes.

Onde está

The articles name no files or commits, only components: the HTTP parser body callback with TLS, HTTP/2 sessions and streams, respondWithFile(), Alt-Svc :authority handling, the maxSessionMemory limit and https.Agent.

Como foi descoberta

Chris Rohlf reported five of the issues in collaboration with Claude and Anthropic Research. Trail of Bits, pimterry and other researchers reported the rest, and Matteo Collina wrote most of the fixes. The Node.js project disclosed them in coordinated security releases. No attacks have been reported and none of the CVEs is in CISA's KEV catalog.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 15:15.