Node.js has released security updates for its 22.x, 24.x and 26.x lines, fixing high-severity flaws in HTTP/2, HTTPS and TLS. The November 11 advisory identifies 22.23.5, 24.22.3 and 26.13.1 as the patched releases.
One significant issue, CVE-2026-123864, can expose memory from other connections through certain HTTPS request handlers. The project says potentially exposed data includes TLS private keys and other users’ requests. Exploitation requires particular application behavior; the advisory says cleartext HTTP is unaffected by this flaw.
A separate high-severity vulnerability, CVE-2026-123872, can bypass client-certificate authentication when a server applies different policies across hostnames and a client renegotiates a TLS 1.2 connection. Other fixes address HTTP/2 crashes, resource exhaustion and memory-safety problems, with affected versions varying by issue.
The 26.13.1 release notes also list medium- and low-severity corrections. Operators should update the runtime across deployed applications and container images, validate compatibility, then redeploy affected workloads. The advisory does not report exploitation in the wild.
