Node.js 26.13.1, 24.22.3, 22.23.5: Fixes for HTTP/2 and TLS Flaws

HTTP/2 session teardown can abort the server and leak sessions #

The CVE-2026-123863 record, published by openjs with a CVSS 3.0 base score of 8.2 (HIGH), describes a reachable assertion in HTTP/2 session teardown that lets any unauthenticated client abort the server, over both TLS and cleartext. The trigger needs only a default http2 server whose handler responds before the request body has ended. The advisory names 24.x and 26.x for this flaw.

The record gives the affected ranges as from 24.0.0 before 24.22.3 and from 25.0.0 before 26.13.1, while its description says the flaw affects 26.x since 26.9.0 and 24.x since 24.22.0. The sources do not reconcile these two statements. The 22.23.5 release notes also list CVE-2026-123863 as High, which the advisory and record do not state for 22.x.

The CVE-2026-123865 record, rated High with a CVSS 3.0 base score of 7.5 by openjs, describes a flaw in which an unauthenticated HTTP/2 client can permanently leak server memory and file descriptors. A protocol error that arrives while the session is already shutting down leaves a dangling session, and the attacker can start that shutdown by sending GOAWAY(NO_ERROR). The record calls it an incomplete fix of CVE-2026-48937 and names 22.x, 24.x and 26.x.

HTTP/2 stream and file-response flaws can leak memory or crash #

The CVE-2026-123866 record, rated High with a CVSS 3.0 base score of 7.5, describes a use-after-free that can send freed or unrelated heap memory to a peer. A stream torn down while a write is backpressured, by a peer RST_STREAM or by the server's own per-stream timeout, leaves a freed response buffer in use. The record says the teardown can be driven by a remote peer on 26.x and 24.x once the window-size change from 26.9.0 and 24.22.0 is present.

The same record states that an application-initiated teardown, such as a per-stream idle timeout, reaches the same defect on all supported lines, which the advisory lists as 22.x, 24.x and 26.x. The CVE-2026-123874 record, also rated High, covers a separate use-after-free of an Http2Stream in servers that call respondWithFile() or respondWithFD(). It names 24.x and 26.x only.

The CVE-2026-123875 record, published by openjs with a CVSS 3.0 base score of 5.9 (MEDIUM), describes a NULL pointer dereference in a StreamPipe that aborts the server when a client cancels a file download. The record says a handful of cancelled requests against a default file-serving handler is enough, and it names 22.x, 24.x and 26.x.

HTTP/2 memory accounting and Alt-Svc origins #

The CVE-2026-123868 record, rated Medium with a CVSS 3.0 base score of 5.9, states that inbound DATA queued on an undrained stream is charged to no session budget. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame, while the server retains about 114 bytes per frame.

The record also says that maxSessionMemory neither bounds this growth nor refuses new streams, because Http2Session::CanAddStream checks a counter that never sees the queue. The advisory names 24.x and 26.x for this flaw, so 22.x is not listed for it there.

The CVE-2026-123828 record, rated Medium with a CVSS 3.0 base score of 5.9, describes a one-byte heap buffer overflow in Http2Session.altsvc() when an application passes an attacker-controlled value such as the :authority header. The record says that a single request with a long but syntactically valid :authority aborts the process, and it names 24.x and 26.x.

HTTPS request parser can return memory from other connections #

The CVE-2026-123864 record, published by openjs with a CVSS 3.0 base score of 8.1 (HIGH), describes a re-entrancy flaw that lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. The record explains that a zero-byte write issued from JavaScript inside the parser's on_body callback re-enters llhttp_execute() while the parser is mid-body.

Triggering it needs a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk. Reading the leaked memory needs any ordinary route that echoes or stores a request body. The record names 22.x, 24.x and 26.x, and it states the following:

Cleartext node:http is not affected.

CVE-2026-123864 record

TLS servers can crash on deferred handshake callbacks #

The CVE-2026-126051 record, rated High with a CVSS 3.0 base score of 7.5 by openjs, describes a TLS server that uses the SNICallback, OCSPRequest, newSession or resumeSession hooks, or server.addContext(). Their OpenSSL callbacks are deferred, and the deferred code does not handle a socket destroyed in between.

A remote, unauthenticated client can send a client hello that reaches this path, followed by padding and a socket FIN. The record says that the process raises an uncaught exception instead of emitting an 'error' event. It names 24.x and 26.x only, and the 22.23.5 release notes do not list this CVE.

TLS client authentication can be bypassed through servername changes #

The CVE-2026-123872 record, rated High with a CVSS 3.0 base score of 8.1 by openjs, describes a client that changes the servername during TLS 1.2 renegotiation. On a server that applies different client-certificate policies per hostname, a client authenticated for a permitted host can reach a protected host under a stricter policy. The advisory names 22.x, 24.x and 26.x.

The release notes list three fixes under this CVE: disabling resumption for mTLS with no session id context, and preventing renegotiation or HRR from changing SNI and TLS resumption from changing SNI. The CVE-2026-123867 record, rated Medium with a CVSS 3.1 base score of 4.2 by openjs, describes a separate per-host mTLS gap. A CA-only SNI context made with server.addContext(host, { ca: protectedCA }) keeps the default client CA, so a client trusted only by the default CA can complete mTLS to the protected host.

https.Agent reuses TLS sessions across CA policies #

The CVE-2026-123877 record, rated Medium with a CVSS 3.0 base score of 6.8, says that a session authenticated under one CA policy can be reused by a later request with a stricter policy. https.Agent.prototype.getName() gives a request that omits ca and one with ca: [] the same session-cache key.

The record explains that TLS 1.3 session resumption then carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject. The advisory names 22.x, 24.x and 26.x.

Proxy URLs leak credentials into ERR_PROXY_INVALID_CONFIG errors #

The CVE-2026-123871 record, rated Medium with a CVSS 3.0 base score of 6.2 by openjs, says Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. Four error paths interpolate the raw proxy URL, credentials included, into the message. The record names 22.x, 24.x and 26.x.

The record notes that the proxy URL comes from the environment, but that the message is the sink, reaching places such as stderr, container logs, log aggregation and crash reporting services.

Low-severity fixes in the Permission Model, fs.watch and zlib #

The CVE-2026-123829 record, rated Low with a CVSS 3.0 base score of 2.5 by openjs, applies to 22.x, 24.x and 26.x. On macOS and Windows, recursive fs.watch forwards file names without checking each path against the read grant. Under --permission with an exact read grant on a directory, a process can learn names such as sub/secret.txt, and the record says the flaw exposes names and timing metadata, not file contents.

The CVE-2026-123862 record, rated Low with a CVSS 3.0 base score of 2.9, describes an uncatchable ERR_INTERNAL_ASSERTION in zlib when a stream is destroyed during a pending params() call, which terminates the process. The record says an application is affected only if it calls deflate.params() while streaming to a peer.

The 22.23.5, 24.22.3 and 26.13.1 release notes list CVE-2026-123873 as Low under "permission: check heap snapshot destination", and the advisory lists CVE-2026-106071 as Low for a wildcard --allow-fs-read or --allow-fs-write rule that can match a shorter path. CVE-2026-123873 has no CVE record in the sources. The CVE-2026-106071 record, published by hackerone with a CVSS 3.0 base score of 3.6 (LOW), lists Node.js up to and including 26.12.0 and calls it a different root cause from the earlier Permission Model flaw CVE-2026-58043, so 26.13.1 already carries that fix; the 24.22.3 and 22.23.5 release notes ship it as "src: fix the fs permission tree node on wildcard nodes" without naming the CVE.

Node.js releases carry these fixes in the three release lines #

The table gives each CVE's affected range from its record, the lines the advisory names, and the releases whose notes list the fix. Fixes listed in the notes are shipped in 26.13.1, 24.22.3 and 22.23.5, with the exceptions shown in the rows.

The 22.23.5 release notes list CVE-2026-123863, CVE-2026-123874, CVE-2026-123828 and CVE-2026-123868, while the advisory and CVE records name only 24.x and 26.x for all four. The 22.23.5 commit list has the HTTP/2 headers fix for CVE-2026-123863 but no commit under the titles of the other three, and the sources do not reconcile this.

Also in this release #

• 26.13.1 dependencies: brotli 1.2.1, llhttp 9.4.4, sqlite 3.54.1 and undici 8.12.4, with undici 8.12.3 (#66993).
• 24.22.3 dependencies: brotli 1.2.1, llhttp 9.4.4, sqlite 3.54.1 and undici 7.30.2 (#67273), with sqlite 3.54.0 (#66663).
• 22.23.5 dependencies: llhttp 9.4.4 and sqlite 3.54.1, with sqlite 3.54.0 (#66663).
• Brotli cherry-pick e230f474b87 (#61003) in 26.13.1 and 24.22.3.
• "build: respect OpenSSL's configured API level" (#66953) and "crypto: fix builds with older OpenSSL 3.0" (#66931) in 26.13.1 and 24.22.3.
• "src: fix the fs permission tree node on wildcard nodes" (#986) in 24.22.3 and 22.23.5.
• "tools: use vendored trust store in shell.nix" (#67318) in 26.13.1.

The complete list is in the 26.13.1 release notes, the 24.22.3 release notes and the 22.23.5 release notes.

Upgrading Node.js to the fixed release lines #

1. On the 26.x line, install 26.13.1, as listed in the 26.13.1 release notes.
2. On the 24.x line, install 24.22.3, as listed in the 24.22.3 release notes.
3. On the 22.x line, install 22.23.5, as listed in the 22.23.5 release notes.
4. For End-of-Life lines, the advisory states that such versions are always affected when a security release occurs, and it points to the Release Schedule for an up-to-date version.

Checking whether an application uses the affected APIs #

Search the application source for the APIs and settings the CVE records name. The pattern below covers respondWithFile and respondWithFD (CVE-2026-123874 and CVE-2026-123875), flushHeaders (CVE-2026-123864), addContext and SNICallback (CVE-2026-126051 and CVE-2026-123867), altsvc (CVE-2026-123828), deflate.params (CVE-2026-123862), and maxSessionMemory (CVE-2026-123868).

grep -rnE "respondWithFile|respondWithFD|flushHeaders|addContext|SNICallback|deflate\.params|altsvc|maxSessionMemory|ERR_PROXY_INVALID_CONFIG" .

Compare the installed version with the affected ranges in the table above. For CVE-2026-123871, the grep also matches the ERR_PROXY_INVALID_CONFIG code, which the record says can appear in messages that contain proxy credentials. For CVE-2026-123872, CVE-2026-123867 and CVE-2026-123877, check any code that sets per-hostname client-certificate policy, passes ca: [] to https.Agent, or uses { ca: protectedCA } with addContext.