Node.js Security Releases Fix HTTPS Memory Exposure
The Node.js project has released 22.23.5, 24.22.3 and 26.13.1 with fixes for HTTPS, TLS and HTTP/2. A high-severity HTTPS bug can let an unauthenticated client read memory from other connections. The project says that memory could include private TLS keys or other users’ requests. Give priority to applications where Node.js itself handles untrusted HTTPS traffic. CVE-2026-123864 · Node.js November security advisory
Check how the application handles TLS and HTTP/2
The HTTPS memory flaw affects all three release lines. The project describes a path an external client can trigger on some 24.x and 26.x versions, and a path involving application-initiated teardown on all three lines. A separate TLS 1.2 flaw can allow a client to carry authentication from one hostname to another during renegotiation when the server uses different client-certificate policies. Review those policies on services that rely on mutual TLS. CVE-2026-123872 · Node.js security advisory
The project also fixes an HTTP/2 use-after-free when a client cancels a file response while a write is pending, and a TLS server crash involving deferred handshake callbacks. For those two issues the advisory identifies the 24.x and 26.x lines. Check applications that serve files directly over Node.js HTTP/2 or use custom TLS handshake hooks. CVE-2026-123874 · CVE-2026-126051
Verify the runtime that actually serves requests
Update the runtime in each deployment, including container images, workers and standby copies. Confirm the version in the restarted service and test HTTP/2 file transfers and mutual TLS where those paths are in use. Review whether a front-end proxy forwards HTTP/2 or TLS to the origin. If there is evidence of memory disclosure, assess which credentials and keys the process could have exposed and rotate them from a trusted environment. 22.23.5 release · 24.22.3 release · 26.13.1 release · BlackTree’s Node.js lifecycle
