Node.js 22.23.5, 24.22.3 and 26.13.1 fix 16 vulnerabilities: HTTP/2 crashes, memory leaks exposing TLS keys, client-certificate bypasses
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 14/11/2026 00:00; os links antigos trazem para cá.
Fontes: cert.cyber.gouv.fr ↗ thehackernews.com ↗ gbhackers.com ↗ securityonline.info ↗
Node.js released security updates on November 11, 2026 for the 22.x, 24.x and 26.x lines, fixed in 22.23.5, 24.22.3 and 26.13.1. The release addresses 16 vulnerabilities: 7 high, 6 medium and 3 low (gbhackers.com). Most affect the HTTP/2 and TLS components. They let unauthenticated remote clients crash servers, read memory belonging to other connections (including TLS private keys and other users' requests), or bypass client-certificate checks. No exploitation in the wild or public exploits have been reported (thehackernews.com, securityonline.info). The earlier 17-vulnerability figure was revised to 16. CERT-FR (cert.cyber.gouv.fr) published an advisory on November 13, 2026 telling users of affected versions to upgrade. Defenders should patch and restart services promptly.
Entenda a falha
A vulnerabilidade
Node.js security releases 22.23.5, 24.22.3 and 26.13.1 fix 16 flaws (7 high, 6 medium, 3 low), mostly in the HTTP/2 and TLS server code. The worst is CVE-2026-123864, which lets an unauthenticated client of an HTTPS server read memory from other connections, including TLS private keys and other users' requests, on all three lines. It needs a handler that calls res.flushHeaders() before the body has arrived and later ends the response with data; plain node:http is not affected. CVE-2026-123863 lets any client abort a default HTTP/2 server on 24.x and 26.x. CVE-2026-123866 can send freed response memory to a peer. CVE-2026-123865 leaks memory and file descriptors, and CVE-2026-123874 corrupts memory in servers using respondWithFile()/respondWithFD(). CVE-2026-126051 crashes TLS servers that use SNI, OCSP or session hooks. CVE-2026-123872 (high) and CVE-2026-123867 bypass client-certificate checks. The rest are medium or low: CVE-2026-123828, 123868, 123875, 123877, 123871 and others. End-of-life lines such as 20.x and 25.x get no fix.
Como funciona
In the HTTPS case, a client request reaches the HTTP parser, whose body callback triggers a zero-length TLS write. That makes Node.js decrypt the next TLS record too early and re-enter the parser while it is still working. The server then reads freed or unrelated heap memory and copies it into the request body, which a route that echoes or stores bodies can expose. In HTTP/2, the problems occur when sessions and streams shut down: a stream outlives its session and an internal assertion fails, a protocol error during shutdown leaves sessions in memory, or a stream is torn down during a backpressured write and freed memory is sent out.
Por que é vulnerável
The memory bugs come from lifecycle and re-entrancy errors: the TLS decrypt step runs inside the parser callback (use-after-free and out-of-bounds read, per securityonline.info), and HTTP/2 streams are used after their session or buffers are gone. Some are variants or incomplete fixes: CVE-2026-123863 is a variant of CVE-2024-27983 that the earlier fix missed, and CVE-2026-123865 is an incomplete fix for CVE-2026-48937. The certificate bypasses are policy mistakes: authentication carries over when the servername changes in TLS 1.2 renegotiation, a CA-only SNI context fails open to the default CA, and a TLS session cached under one trust policy is reused under a stricter one. CVE-2026-123868 lets queued data escape the maxSessionMemory limit. The fixes correct these paths; the articles give no more detail.
Onde está
The articles name no file or commit, only components and APIs: HTTP/2 session and stream teardown, the HTTPS/TLS body-parsing path, res.flushHeaders(), session.altsvc(), respondWithFile()/respondWithFD(), the maxSessionMemory limit and the ERR_PROXY_INVALID_CONFIG message.
Como foi descoberta
According to the Node.js advisory cited by the press, Chris Rohlf reported five of the flaws, including CVE-2026-123863 and CVE-2026-123864, in collaboration with Claude and Anthropic Research. Trail of Bits, pimterry, aidan02 and other researchers reported the rest, and Matteo Collina wrote most fixes, with RafaelGSS and jasnell also contributing. The fixes were released on November 11, 2026 per the press (CERT-FR points to a Node.js bulletin dated November 3, a discrepancy that is unresolved), and CERT-FR published advisory CERTFR-2026-AVI-1531 on November 13. The count was reported as 17 by securityonline.info and 16 by the others. No exploitation has been reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 00:16.
Detalhes técnicos
- CVE-2026-123863: HTTP/2 session teardown. An unauthenticated client can abort the server by exploiting normal behavior when the server responds before the request body has fully arrived. Default HTTP/2 servers are exposed (gbhackers.com, thehackernews.com).
- CVE-2026-123864: affects HTTPS servers. An unauthenticated client can read memory from other connections, including TLS private keys and other users' requests, under specific conditions involving premature header flushing. gbhackers.com describes it as a re-entrancy bug. securityonline.info attributes it to a TLS parser use-after-free and out-of-bounds read.
- CVE-2026-123866: HTTP/2 flaw that can leak parts of server memory, exposing data meant for other connections (thehackernews.com).
- Client-certificate bypasses include CVE-2026-123872 and CVE-2026-123867 (gbhackers.com). Other fixes cover resource exhaustion and memory corruption (thehackernews.com).
- Some issues are variants or incomplete fixes of earlier CVEs (gbhackers.com). Many can be triggered on default server configurations (securityonline.info).
- The release also updates dependencies llhttp, undici and sqlite (gbhackers.com).
- Credited researchers: Chris Rohlf, Claude and Anthropic Research, Trail of Bits, pimterry, aidan02 and lead fixer Matteo Collina (securityonline.info, gbhackers.com).
- CERT-FR lists CVE-2024-27983 along with several 2026 CVEs (cert.cyber.gouv.fr).
Remediação
- Upgrade to 22.23.5, 24.22.3 or 26.13.1 and restart affected services. CERT-FR lists versions earlier than these as affected.
- End-of-life lines such as 20.x and 25.x receive no patches and remain vulnerable (thehackernews.com). Move them to a supported line.
- If immediate patching is impossible, limit public exposure of HTTP/2 and file-serving endpoints (gbhackers.com), or proxy HTTP/2 traffic (securityonline.info). See the conflicting reports below on whether workarounds exist.
Relatos divergentes
- Number of vulnerabilities: securityonline.info reports 17. gbhackers.com and thehackernews.com report 16, and gbhackers.com's 7/6/3 severity split adds up to 16. The 16 figure is more recent and better supported.
- Exploitation: thehackernews.com and securityonline.info say no exploitation has been reported. gbhackers.com mentions a potential active-exploitation context linked to previous flaws, without evidence of exploitation of these CVEs.
- Workarounds: thehackernews.com says the advisory offers no mitigation other than upgrading. securityonline.info and gbhackers.com suggest reducing HTTP/2 exposure or proxying as stopgaps. These are interim measures, not fixes.
- Bulletin date: cert.cyber.gouv.fr points to an official Node.js bulletin dated November 3, 2026. The other sources date the release to November 11, 2026. The discrepancy is unresolved.
Linha do tempo
-
Multiple Security Vulnerabilities in Node.js Affecting Data Confidentiality, Security Policy, and Availability
ler a análise desta fonte ocultar
The French CERT-FR has reported multiple vulnerabilities in Node.js affecting versions prior to 24.22.3 (24.x), 26.13.1 (26.x), and 22.23.5. These flaws allow attackers to compromise data confidentiality, bypass security policies, and cause denial of service. Detailed version management is provided in the advisory. Users are urged to refer to the official Node.js security bulletin dated November 3, 2026, for patches and further information. The vulnerabilities include CVE-2024-27983 and multiple CVEs assigned in 2026, highlighting the need for urgent updates to maintain secure environments.
-
Node.js Fixes 16 Vulnerabilities Including HTTP/2 Server Crashes and Memory Leaks in 22.x, 24.x, and 26.x Lines
This article updates the known report by confirming the fixed number of vulnerabilities at 16 (revising the previously cited 17), detailing specific CVEs such as CVE-2026-123863 and CVE-2026-123864 with precise attack prerequisites and server behaviors, and emphasizing the absence of any known exploitation in the wild. It also specifies the exact patched versions per supported line and underscores that end-of-life lines like 20.x and 25.x remain unpatched and vulnerable. Furthermore, it highlights that nodes running default HTTP/2 servers are exposed to the crash vulnerability and that no mitigations other than upgrading are provided in the advisory.
ler a análise desta fonte ocultar
This article updates the known report by confirming the fixed number of vulnerabilities at 16 (revising the previously cited 17), detailing specific CVEs such as CVE-2026-123863 and CVE-2026-123864 with precise attack prerequisites and server behaviors, and emphasizing the absence of any known exploitation in the wild. It also specifies the exact patched versions per supported line and underscores that end-of-life lines like 20.x and 25.x remain unpatched and vulnerable. Furthermore, it highlights that nodes running default HTTP/2 servers are exposed to the crash vulnerability and that no mitigations other than upgrading are provided in the advisory.
Node.js has released critical security updates addressing 16 vulnerabilities across its 22.x, 24.x, and 26.x release lines, including seven rated high severity. Of particular concern are HTTP/2 flaws such as CVE-2026-123863, allowing unauthenticated clients to crash servers by exploiting normal server behavior when responding before the request body fully arrives, and CVE-2026-123866, which could leak parts of server memory, exposing data intended for other connections. Additionally, CVE-2026-123864 impacts HTTPS servers, enabling unauthenticated clients to read memory from other connections including TLS private keys and other users' requests under specific conditions involving premature header flushing. Other critical flaws include resource exhaustion, memory corruption, and TLS client certificate bypasses. The update fixes for these are included in versions 22.23.5, 24.22.3, and 26.13.1. No exploitation in the wild has been reported to date. The Node.js project recommends immediate updating with no workaround available. Credited researchers include Chris Rohlf and teams from Claude and Anthropic Research.
-
Node.js Updates Fix 16 Vulnerabilities Including Memory Leaks, Server Crashes, and TLS Authentication Bypasses
This report updates the known case by specifying that the patched versions are 22.23.5, 24.22.3, and 26.13.1, confirming the total vulnerabilities as 16 (not 17 as previously reported). It adds details about multiple specific CVEs such as CVE-2026-123863 (HTTP/2 session teardown causing server abort), CVE-2026-123864 (HTTPS re-entrancy bug leaking TLS keys), and authentication bypasses including CVE-2026-123872 and CVE-2026-123867. It confirms these are variants or incomplete fixes of earlier CVEs, indicating an ongoing remediation effort. It highlights dependency updates and broader researcher contributions, adding depth to attribution and remedial measures advised, such as limiting public exposure to HTTP/2 and file-serving endpoints if immediate patching is not possible.
ler a análise desta fonte ocultar
This report updates the known case by specifying that the patched versions are 22.23.5, 24.22.3, and 26.13.1, confirming the total vulnerabilities as 16 (not 17 as previously reported). It adds details about multiple specific CVEs such as CVE-2026-123863 (HTTP/2 session teardown causing server abort), CVE-2026-123864 (HTTPS re-entrancy bug leaking TLS keys), and authentication bypasses including CVE-2026-123872 and CVE-2026-123867. It confirms these are variants or incomplete fixes of earlier CVEs, indicating an ongoing remediation effort. It highlights dependency updates and broader researcher contributions, adding depth to attribution and remedial measures advised, such as limiting public exposure to HTTP/2 and file-serving endpoints if immediate patching is not possible.
The Node.js project released security updates on November 11, 2026 for versions 22.x, 24.x, and 26.x, addressing 16 vulnerabilities categorized as 7 high, 6 medium, and 3 low severity. These flaws chiefly affect HTTP/2 and TLS handling components, enabling unauthenticated remote attackers to cause server crashes, memory leaks involving sensitive data like TLS private keys, and bypass client-certificate authentication mechanisms. Notable vulnerabilities include CVE-2026-123863, allowing server aborts via HTTP/2 session teardown, and CVE-2026-123864, a re-entrancy bug exposing TLS secrets. Some issues represent incomplete fixes or variants of earlier vulnerabilities. Researchers from several teams, including Chris Rohlf, Claude, Anthropic Research, pimterry, aidan02, and Trail of Bits, contributed to identifying these flaws. The update also includes upgrades to dependencies like llhttp, undici, and sqlite. Administrators are advised to promptly upgrade and restart affected services due to the severity and potential active exploitation context linked to previous flaws.
-
Node.js fixes 17 vulnerabilities including high-risk HTTP/2 memory leaks and TLS certificate bypasses in releases 26.13.1, 24.22.3, 22.23.5
ler a análise desta fonte ocultar
The Node.js project released security updates (26.13.1, 24.22.3, and 22.23.5) addressing 17 vulnerabilities, including seven rated high. Many vulnerabilities affect the HTTP/2 implementation and TLS handling, allowing unauthenticated clients to crash servers, leak heap memory, or bypass client-certificate checks. Notably, CVE-2026-123864 can expose TLS private keys and user request data due to a TLS parser use-after-free and out-of-bounds read. While no active exploitation or public exploits have been reported, these flaws pose significant risks especially since many can be triggered on default server configurations. Users are urged to upgrade to the patched releases and consider proxying HTTP/2 traffic pending updates. The Node.js team credited several researchers including Chris Rohlf, Claude and Anthropic Research, Trail of Bits, pimterry, and lead fixer Matteo Collina for their work.