On this page
If your website or API runs on Node.js and answers visitors directly, a stranger on the internet could knock it offline or, in one case, make it hand them pieces of other visitors' requests, including the secret key that protects your HTTPS traffic. Node.js shipped fixes for 16 security bugs on Nov 11, 2026. The fixed releases are Node.js 22.23.5, 24.22.3 and 26.13.1. The most serious one for most teams is CVE-2026-123864, a memory leak in the HTTPS server that needs no login.
Most of the 16 live in two places: Node's built-in HTTP/2 server and its TLS (HTTPS) code. That matters for who needs to move today, because a lot of Node apps never expose either one to the internet. The section on who is not affected below is the part to read before you page anyone.
How to fix
Upgrade to the patched release on your line, then restart the process. Installing a new binary does nothing to a server that is still running the old one.
# nvm
nvm install 24.22.3 # or 22.23.5, or 26.13.1
nvm alias default 24.22.3
# Docker: rebuild on a fresh base image, then confirm inside the container
docker pull node:24
docker run --rm node:24 node -v
# Volta
volta install [email protected]If you install Node from your Linux distribution's packages, wait for the distro build and check its changelog for these CVE IDs rather than the version number, since distros often backport. Node 20 and older, and odd-numbered lines like 25, are end of life. The Node.js project says end-of-life versions are always affected by a security release, and they get no fix.
Check whether this applies to you
Three checks cover almost everyone. First, the version that is actually running:
node -vAnything below 22.23.5 on the 22 line, 24.22.3 on the 24 line or 26.13.1 on the 26 line is unpatched. Second, find out whether your code serves HTTP/2 or HTTPS itself:
grep -rnE "node:http2|require\(['\"]http2|createSecureServer|https\.createServer|tls\.createServer" --include=*.js --include=*.mjs --include=*.ts .Third, see what your Node process is listening on. If it is bound to port 443 on a public address, it is speaking TLS to the internet directly:
ss -ltnp | grep nodeWho is not affected
- Apps that only serve plain HTTP behind a proxy. A typical Express or Fastify app listening with
node:httpbehind nginx, Caddy, Cloudflare or a cloud load balancer that handles HTTPS never lets a stranger speak TLS or HTTP/2 to Node. The release notes say cleartextnode:httpis not affected by CVE-2026-123864, and the HTTP/2 bugs need Node's ownhttp2server. Check that your proxy talks HTTP/1.1 to Node; some load balancers can be set to forward HTTP/2 to the app. - Frontend-only projects. If Node only runs your build tools or tests and never accepts connections, the server bugs do not reach you. Upgrade on your normal schedule.
- Servers that do not use client certificates. The two login bypasses (CVE-2026-123872 and CVE-2026-123867) only matter if your Node server checks client certificates (mutual TLS) and uses different rules for different hostnames.
What this is not
None of the 16 is described by the Node.js team as a way to run code on your server, none is on CISA's list of exploited bugs, and there are no public reports of anyone using them. Several are memory corruption bugs, so treat them seriously, but the documented impact is crashes, memory exhaustion, data leaks and two certificate checks that can be skipped.
The ones worth reading closely
HTTPS leaks other connections' memory (CVE-2026-123864, high, 22.x, 24.x and 26.x). When a request handler calls res.flushHeaders() before the request body has finished arriving, a zero-length TLS write can re-enter Node's HTTP parser in the middle of the body. The server then copies freed heap memory into what it believes is the request body. To read it, an attacker only needs a route that echoes or stores what they send, which describes a lot of APIs. The release notes say that memory can include TLS private keys and other users' requests. If you serve HTTPS from Node directly and stream responses early, this is your reason to patch today and to consider rotating the certificate key after you do.
One request can crash an HTTP/2 server (CVE-2026-123863, high, 24.x and 26.x). A client can leave a stream alive after its session closes, which trips an internal assertion and kills the process. The trigger is a handler that answers before the request body ends, which is ordinary code. It is a variant of CVE-2024-27983 that the earlier fix missed. Two more crash bugs sit next to it: cancelling a respondWithFile() download (CVE-2026-123875) and a crafted TLS hello against servers that use SNICallback, OCSP or session hooks (CVE-2026-126051).
HTTP/2 servers can be slowly drained (CVE-2026-123865 and CVE-2026-123868). One leaves dead sessions holding memory and file descriptors forever after a protocol error during shutdown. The other lets a client make the server hold about 114 bytes for every 10 bytes it sends, and maxSessionMemory does not count it.
Client certificate checks can be skipped (CVE-2026-123872 and CVE-2026-123867). On a server with stricter client-certificate rules for one hostname, such as an admin host, a client approved for a different hostname can reach the strict one: through TLS 1.2 renegotiation in the first case, and through a server.addContext() entry that sets a CA but no server certificate in the second.
Smaller items. Proxy passwords could appear in ERR_PROXY_INVALID_CONFIG error messages and end up in logs (CVE-2026-123871). https.Agent could reuse a TLS session across two different CA settings (CVE-2026-123877). Two Permission Model gaps let code see names of files it was not allowed to read, or match a wildcard grant too widely (CVE-2026-123829, CVE-2026-106071). The release also updates the bundled llhttp, undici and SQLite.
If you cannot upgrade today
Put a proxy in front that terminates TLS and HTTP/2 and speaks HTTP/1.1 to Node. That removes a stranger's direct path to most of these bugs. Make sure a process manager or orchestrator restarts Node when it exits, so a crash costs seconds instead of an outage. If you use client-certificate rules per hostname, disable TLS 1.2 renegotiation or require TLS 1.3 on that server until you patch.
Five of these bugs were reported by Chris Rohlf working with Claude and Anthropic Research, and one by Trail of Bits, which is a sign of how quickly AI-assisted bug hunting is finding issues in core runtimes. AI coding agents also run Node on developer machines all day. HOL Guard is the free tool we build to see and approve what those agents run; it does not patch Node, so the upgrade above is still the fix. Our Guard record for CVE-2026-123864 keeps the source links and affected versions.
For the last Node.js bug we covered, see the Brotli decoder flaw from October, which was later added to CISA's exploited list. Related Node package bugs: body-parser compressed bodies and undici WebSocket deflate.
What do people ask about the November 2026 Node.js security release?
Which Node.js versions fix CVE-2026-123864?
Node.js 22.23.5, 24.22.3 and 26.13.1. All three were released for the Nov 11, 2026 security release.
Is my Express app affected?
Only if Node itself handles HTTPS or HTTP/2 for it. An Express app on plain node:http behind a proxy that terminates HTTPS is not exposed to the HTTPS memory leak or the HTTP/2 crashes, but you should still upgrade.
Are these Node.js bugs being exploited?
There are no public reports of exploitation, and none of the 16 CVEs is on CISA's Known Exploited Vulnerabilities list as of Nov 11, 2026.
Is Node.js 20 getting a fix?
No. Node.js 20 is end of life, and the Node.js project says end-of-life versions are always affected. Move to 22.23.5 or 24.22.3.
Should I rotate my TLS certificate key?
If a public Node.js process served HTTPS directly on an unpatched version and has routes that echo or store request bodies, rotating the key after patching is a reasonable precaution, because CVE-2026-123864 can leak heap memory that may include it.
