Node.js 22.23.5, 24.22.3 and 26.13.1 Patch 16 Flaws, 7 Rated High

The Node.js project published security releases for its 22.x, 24.x and 26.x lines on Wednesday, 11 November 2026, according to the official November 2026 security release notice. The update fixes 16 vulnerabilities: seven rated High, six Medium and three Low. The highest severity fixed on every supported line is High.

Most of the High issues sit in the HTTP/2 and TLS server code that public-facing Node.js services rely on. Several can be reached by an unauthenticated client, so internet-facing servers are the most exposed. The advisory does not publish CVSS scores, and Tech Bytes is not adding any.

01Patched Node.js versions for 22.x, 24.x and 26.x

The fixed builds are Node.js 22.23.5, 24.22.3 and 26.13.1. Each line received High-severity fixes, so no supported line can skip this round.

The release also updates bundled dependencies to address public vulnerabilities. The llhttp HTTP parser is updated on 22.x, 24.x and 26.x. The undici HTTP client is updated on 24.x and 26.x, and SQLite is updated on 22.x and 24.x.

The advisory links a separate release page for each of the three versions in its downloads and release details section. Those pages are where teams can confirm the exact build they are installing.

Of the 16 issues, 12 affect all three lines. The other four, three High and one Medium, affect only 24.x and 26.x, which means 22.x carries fewer of the HTTP/2 fixes.

02Seven High-severity HTTP/2 and TLS flaws

Five of the seven High issues are in HTTP/2 handling, and the other two are in TLS. The table below gives one plain impact line per issue, taken from the advisory.

The memory disclosure in CVE-2026-123864 is the one with the widest reach. The advisory says it affects HTTPS servers on all three lines, and that cleartext HTTP servers built on the core http module are not affected. Leaked TLS keys or other users' requests would be a confidentiality problem, not just an outage.

The remaining HTTP/2 issues range from crashes to memory corruption and resource leaks. CVE-2026-123872 is different in kind: it is an authorization problem for TLS servers that rely on client certificates per hostname.

03Six Medium and three Low issues

The six Medium issues mix more HTTP/2 denial-of-service bugs with certificate and credential handling flaws. Two of them weaken mutual-TLS or certificate checks rather than crashing anything.

The three Low issues all need narrower conditions. Two involve the Node.js Permission Model, and one involves an uncommon zlib streaming pattern.

The credential leak in CVE-2026-123871 follows an earlier fix for the same class of bug. The advisory says that earlier fix redacted proxy credentials in one place but missed four other error paths in the same subsystem.

04Researchers credited in the advisory

The advisory credits Chris Rohlf, working with Claude and Anthropic Research, for five issues. Those are CVE-2026-123863, CVE-2026-123864 and CVE-2026-123874 at High, CVE-2026-123875 at Medium and CVE-2026-123862 at Low.

The researcher pimterry reported three High issues: CVE-2026-123865, CVE-2026-126051 and CVE-2026-123872. The same researcher is also credited with fixing the two TLS issues. The reporter aidan02 is credited for CVE-2026-123866.

The Medium issues were reported by zonduu, aur0r4_glyph, jiri1234, p-v-p, the pair aegis1337 and mickeyjoe, and Chris Rohlf's team. For the Low issues, the advisory credits Trail of Bits (OpenAI) and malikhamzaiqbal alongside Chris Rohlf's team.

On the fixing side, maintainer mcollina is named on most of the HTTP/2, TLS and credential fixes. RafaelGSS and jasnell are credited with the two Permission Model fixes.

05Upgrade path and end-of-life release lines

The Node.js project's guidance is to move to the patched version on each line: 22.23.5, 24.22.3 or 26.13.1. Teams running HTTPS or HTTP/2 servers exposed to the internet have the most reason to move quickly, given the unauthenticated High issues.

The advisory notes that end-of-life versions are always affected when a security release occurs. It points users to the Node.js Release Schedule to confirm their line is still supported. Tech Bytes has not listed EOL dates here; check the schedule directly.

Container images and managed runtimes pin their own Node.js builds, so a host upgrade does not always reach the app. Rebuilding images on the patched base and checking the reported version at runtime confirms the fix landed. The project's security policy and the nodejs-sec mailing list carry future release notices.