Node.js security releases fix flaws that can leak memory from HTTPS servers or crash them (CVE-2026-123864)

12 November 2026High 8.1

Node.js · Node.js 22, 24 and 26 · CVE-2026-123864

Node.js security releases fix flaws that can leak memory from HTTPS servers or crash them

The Node.js project released updates on 11 November fixing 16 flaws, seven of them rated high. The most serious, CVE-2026-123864, lets a client that has not logged in read memory belonging to other connections on an HTTPS server, which NVD's entry says can include TLS private keys and other users' requests. Several of the others let a remote client crash a server or exhaust its memory through HTTP/2 or TLS. Node.js runs underneath Next.js and most modern web apps, so this reaches a lot of sites.

Affected: Node.js 22.x before 22.23.5, 24.x before 24.22.3 and 26.x before 26.13.1. CVE-2026-123864 affects all three lines when serving HTTPS; plain HTTP through node:http is not affected. Some of the HTTP/2 and TLS crash flaws affect only 24.x and 26.x.
What to do: Update to Node.js 22.23.5, 24.22.3 or 26.13.1 and restart or redeploy your apps so they pick up the new runtime. On managed hosting, check which Node.js version your builds and functions actually run on. Only the 22, 24 and 26 lines received these fixes, so move anything on an older line to one of them.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Node.js is the runtime under Next.js and much of the web tooling our clients' sites rely on.

Node.js security releases fix flaws that can leak memory from HTTPS servers or crash them

Affected

Node.js 22.x before 22.23.5, 24.x before 24.22.3 and 26.x before 26.13.1. CVE-2026-123864 affects all three lines when serving HTTPS; plain HTTP through node:http is not affected. Some of the HTTP/2 and TLS crash flaws affect only 24.x and 26.x.

What to do

Update to Node.js 22.23.5, 24.22.3 or 26.13.1 and restart or redeploy your apps so they pick up the new runtime. On managed hosting, check which Node.js version your builds and functions actually run on. Only the 22, 24 and 26 lines received these fixes, so move anything on an older line to one of them.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Node.js is the runtime under Next.js and much of the web tooling our clients' sites rely on.