---
title: Node.js 22.23.5, 24.22.3 and 26.13.1 fix seven high-severity bugs, including an HTTPS heap leak that can expose TLS private keys and two mTLS bypasses | ctxsec
url: https://ctxsec.com/items/nodejs-nov-11-2026-security-releases-http2-tls-heap-leak-mtls-bypass
description: "The Node.js project shipped security releases for all active lines on Nov 11. The most serious: CVE-2026-123864, where a zero-length TLS write from inside a request-body handler re-enters the HTTP parser and copies other connections' heap memory, including TLS private keys, into the request body; CVE-2026-123866, an HTTP/2 use-after-free that can send freed response memory to a peer; CVE-2026-123874, an HTTP/2 use-after-free in respondWithFile(); and CVE-2026-123872, where a client changes the servername during TLS 1.2 renegotiation to bypass per-host client-certificate rules. Several more let an unauthenticated client crash or exhaust HTTP/2 and TLS servers. Node.js credits Chris Rohlf working with Claude and Anthropic Research for five of the fixes."
status: "official (Node.js security release, Nov 11, 2026); no exploitation reported"
published: 2026-11-11
---

> The Node.js project shipped security releases for all active lines on Nov 11. The most serious: CVE-2026-123864, where a zero-length TLS write from inside a request-body handler re-enters the HTTP parser and copies other connections' heap memory, including TLS private keys, into the request body; CVE-2026-123866, an HTTP/2 use-after-free that can send freed response memory to a peer; CVE-2026-123874, an HTTP/2 use-after-free in respondWithFile(); and CVE-2026-123872, where a client changes the servername during TLS 1.2 renegotiation to bypass per-host client-certificate rules. Several more let an unauthenticated client crash or exhaust HTTP/2 and TLS servers. Node.js credits Chris Rohlf working with Claude and Anthropic Research for five of the fixes.

[← Cybersecurity News](/news) · [markdown](/items/nodejs-nov-11-2026-security-releases-http2-tls-heap-leak-mtls-bypass.md)

official (Node.js security release, Nov 11, 2026); no exploitation reported

2026-11-11 7:41 PM ET

### Node.js 22.23.5, 24.22.3 and 26.13.1 fix seven high-severity bugs, including an HTTPS heap leak that can expose TLS private keys and two mTLS bypasses

- **Upgrade:** 22.23.5, 24.22.3 or 26.13.1; end-of-life lines stay vulnerable. Restart long-running processes after upgrading.
- **Crashes and exhaustion (high):** CVE-2026-123863 (HTTP/2 teardown assertion, 24/26), CVE-2026-123865 (HTTP/2 sessions never cleaned up after a shutdown-time protocol error), CVE-2026-126051 (TLS servers using SNICallback, OCSP or session hooks, 24/26).
- **Medium:** CVE-2026-123867, a CA-only SNI context silently falls back to the default client CA (mTLS bypass); CVE-2026-123877, https.Agent reuses a TLS session across different CA policies; CVE-2026-123828 (Alt-Svc one-byte overflow), CVE-2026-123868 (HTTP/2 memory not charged to maxSessionMemory), CVE-2026-123875 (respondWithFile cancel crash), CVE-2026-123871 (proxy credentials in error messages).
- **Also:** llhttp, undici and sqlite dependency updates, and two low-severity Permission Model fixes.

Sources: [Node.js: Wednesday, November 11, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases)