"including TLS private keys and other users' requests," the project says.
CVE-2026-123863 and HTTP/2 crashes that any client can trigger
Node.js released patched builds this week after a flaw, tracked as CVE-2026-123863, was found to let unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. The project said the crash requires only a default HTTP/2 server that replies before the request body has fully arrived — a behavior the project calls typical — and that the problem can be exploited over both TLS and cleartext connections. Fixed releases were published for all three supported lines as 22.23.5, 24.22.3, and 26.13.1.
CVE-2026-123866 and cross-connection memory disclosures over HTTP/2
A second HTTP/2 flaw, CVE-2026-123866, can cause a server to send a client fragments of its own memory, including responses intended for other connections. The advisory says the issue affects all three supported lines. From 24.22.0 and 26.9.0 onward, a client alone can trigger the memory disclosure; on 22.x and older 24.x and 26.x builds it can still be triggered when the server itself closes a stream partway through a response, such as after an idle timeout.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCVE-2026-123864: HTTPS handlers, flushHeaders(), and leaked TLS secrets
A separate HTTPS flaw, CVE-2026-123864, can allow an unauthenticated client to read memory from other connections, "including TLS private keys and other users' requests," the Node.js project warned. The advisory ties the vulnerability to a specific handler pattern: code that calls res.flushHeaders() before the request body has fully arrived and later calls res.end() with data. The advisory also notes that reading leaked memory requires a route that sends back or stores a request body; plain HTTP servers built with node:http are not affected.
Other high-rated flaws and the server behaviors they touch
- CVE-2026-123865 — a client can cause any default HTTP/2 server to hold memory and file descriptors permanently; affects all three supported lines.
- CVE-2026-123874 — a client can corrupt server memory on 24.x and 26.x when the server serves files with stream.respondWithFile() or stream.respondWithFD().
- CVE-2026-123875 — canceling downloads served with respondWithFile()/respondWithFD() can crash the server on all three lines (rated medium).
- CVE-2026-126051 — a client can crash a TLS server on 24.x and 26.x when the server uses SNICallback, OCSPRequest, newSession or resumeSession hooks, or server.addContext().
- CVE-2026-123872 — on TLS servers that apply stricter client-certificate rules for some hostnames, a client approved for one hostname can switch to a stricter one during TLS 1.2 renegotiation without meeting its rules; all three lines are affected.
The advisory emphasized that these eight flaws are all in Node.js's own HTTP/2, HTTPS and TLS server code — in other words, they matter where a Node.js process accepts those connections itself.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: The project's only remediation is updating to the fixed versions — 22.23.5, 24.22.3, and 26.13.1 — and the advisory lists no workaround for systems that cannot update. The advisory also does not report any active exploitation.
- Procurement and affected enterprises: End-of-life lines such as 20.x and 25.x receive no fix and are "always affected," the project said — a concrete compatibility and risk consideration for organizations that have not migrated off those releases.
- End users and operations teams: Systems using the specific handler pattern that calls res.flushHeaders() before the body arrives, and then res.end() with data, should prioritize updates; plain node:http servers are not affected by the HTTPS handler flaw described.
The Node.js security advisory credits Chris Rohlf in collaboration with Claude and Anthropic Research for reporting five of the flaws, including CVE-2026-123863 and CVE-2026-123864. It also notes that the advisory does not say whether servers that met the conditions for the HTTPS flaw should replace TLS keys or other secrets after updating.
Practical next steps are narrow and specific: update to 22.23.5, 24.22.3, or 26.13.1 as applicable. The project's advisory provides no alternate mitigations, does not report observed exploitation, and leaves the question of post-remediation key rotation open — a detail that will shape incident-response decisions where sensitive keys or stored request bodies may have been exposed.
https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html
