Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
Node.js has released updates fixing 16 vulnerabilities, including critical HTTP/2 flaws that can crash servers and leak sensitive data between connections.
The most severe vulnerabilities include CVE-2026-123863, which allows unauthenticated clients to crash servers using Node.js's HTTP/2 support on versions 24.x and 26.x. Another critical flaw, CVE-2026-123866, enables servers to send clients pieces of their memory, including responses intended for other connections. Fixed versions have been released for all supported lines: 22.23.5, 24.22.3, and 26.13.1.
HTTPS Server Vulnerability
A separate HTTPS server flaw, CVE-2026-123864, can allow unauthenticated clients to read memory from other connections, including TLS private keys and other users' requests. This affects all three supported lines and requires specific server configurations involving res.flushHeaders() and res.end() methods. Plain HTTP servers built with node:http are not affected by this particular vulnerability.
Other Critical Flaws
Four additional high-rated vulnerabilities were addressed, including CVE-2026-123865, which lets clients make HTTP/2 servers hold memory permanently, and CVE-2026-123874, which enables memory corruption when serving files. CVE-2026-126051 can crash TLS servers using certain hooks, while CVE-2026-123872 bypasses client-certificate rules during TLS renegotiation.
Impact and Recommendations
The advisory reports no known attacks exploiting these vulnerabilities, though end-of-life versions including 20.x and 25.x remain vulnerable. Five of the flaws, including the critical HTTP/2 issues, were discovered by Chris Rohlf in collaboration with Claude and Anthropic Research. System administrators should prioritize updating to the latest versions to prevent potential exploits.
Related
