Node.js 22.23.5, 24.22.3 and 26.13.1 fix seven high-severity bugs, including an HTTPS heap leak that can expose TLS private keys and two mTLS bypasses
- Upgrade: 22.23.5, 24.22.3 or 26.13.1; end-of-life lines stay vulnerable. Restart long-running processes after upgrading.
- Crashes and exhaustion (high): CVE-2026-123863 (HTTP/2 teardown assertion, 24/26), CVE-2026-123865 (HTTP/2 sessions never cleaned up after a shutdown-time protocol error), CVE-2026-126051 (TLS servers using SNICallback, OCSP or session hooks, 24/26).
- Medium: CVE-2026-123867, a CA-only SNI context silently falls back to the default client CA (mTLS bypass); CVE-2026-123877, https.Agent reuses a TLS session across different CA policies; CVE-2026-123828 (Alt-Svc one-byte overflow), CVE-2026-123868 (HTTP/2 memory not charged to maxSessionMemory), CVE-2026-123875 (respondWithFile cancel crash), CVE-2026-123871 (proxy credentials in error messages).
- Also: llhttp, undici and sqlite dependency updates, and two low-severity Permission Model fixes.
Sources: Node.js: Wednesday, November 11, 2026 Security Releases