Sixteen CVEs in the Plumbing: Node.js Patches Its HTTP/2 and TLS Stack

On Wednesday, November 11, the Node.js project shipped security releases for all three supported lines, fixing 16 vulnerabilities: seven rated High, six Medium, three Low. The headliners: an HTTPS bug that can leak memory from other connections, private keys included, and an HTTP/2 flaw that lets any unauthenticated client abort the process. The patched builds are 26.13.1, 24.22.3 and 22.23.5; 26.13.1 is now the latest LTS build of Lithium, two weeks after 26.x was promoted on October 28 (covered here yesterday). The first question is architectural: where does your TLS actually end?

The leak, the crash, and fourteen neighbours

The leak is CVE-2026-123864. A zero-length TLS write fired mid-body re-enters the HTTP parser, causing a use-after-free and an out-of-bounds heap read; Node says an unauthenticated client can read other connections' memory, including TLS private keys. The trigger is narrow: a handler that calls res.flushHeaders() before the body has arrived and later res.end() with a non-empty chunk, plus a route that echoes or stores bodies to read it back. Cleartext node:http is not affected. All three lines are.

The crash is CVE-2026-123863. A stream holding nghttp2 header buffers can outlive its session, so an accounting assertion fails at teardown and the process aborts. The precondition is a default HTTP/2 server whose handler responds before the request body ends, over TLS or cleartext. Node calls it a variant of CVE-2024-27983 that the earlier fix missed, affecting 24.x and 26.x.

The rest keep the same address: seven of the 16 sit in HTTP/2, and the TLS group includes a handshake crash for servers using SNICallback, OCSP or session hooks (CVE-2026-126051) and a renegotiation that carries a client certificate to a stricter host (CVE-2026-123872). Two Medium fixes are client-side: https.Agent could resume a TLS session across different ca policies (CVE-2026-123877), and proxy credentials leaked into ERR_PROXY_INVALID_CONFIG messages (CVE-2026-123871). The Low tier covers the Permission Model and zlib.

By the advisory's affected-lines column, all 16 apply to 26.x and 24.x, and 11 to 22.x. Dependencies ride along: llhttp 9.4.4 and sqlite 3.54.1 on every line, brotli 1.2.1 on 24.x and 26.x, and undici 7.30.2 on 24.x and 8.12.4 on 26.x. None of the notes lists an OpenSSL update.

It is the second security release in three weeks: the October 21 release fixed 10 (four High, three Medium, three Low) in 26.12.1, 24.22.1 and 22.23.4.

Where TLS ends decides whether you are exposed

Most of these bugs need Node to speak TLS or HTTP/2. If a proxy or load balancer terminates TLS and talks plain HTTP/1.1 to your service, the leak does not apply (cleartext node:http is unaffected) and the server-side TLS bugs have nothing to bite. HTTP/2 is the gap: the crash and several siblings work over cleartext too, so a proxy that speaks h2c to its upstream forwards the problem rather than absorbing it.

Outbound traffic is the other gap: the https.Agent and proxy-credential fixes concern requests your service makes, which no ingress proxy fronts.

In NestJS, TLS terminates in Node via httpsOptions on Express or https on the FastifyAdapter, and HTTP/2 via http2: true, which the adapter passes through to Fastify and its constructor type accepts as secure HTTP/2 options. This setup puts every HTTP/2 and TLS server bug in scope:

1// src/main.ts: TLS and HTTP/2 both terminate inside Node here
2import { readFileSync } from 'node:fs';
3import { NestFactory } from '@nestjs/core';
4import { FastifyAdapter, NestFastifyApplication } from '@nestjs/platform-fastify';
5import { AppModule } from './app.module';
6
7async function bootstrap() {
8  const app = await NestFactory.create<NestFastifyApplication>(
9    AppModule,
10    new FastifyAdapter({
11      http2: true,
12      https: {
13        key: readFileSync('./secrets/private-key.pem'),
14        cert: readFileSync('./secrets/public-certificate.pem'),
15      },
16    }),
17  );
18  await app.listen(process.env.PORT ?? 3000, '0.0.0.0');
19}
20bootstrap();

To check a repository, grep for those constructors and the advisory's preconditions; a hit is a handler to read, not proof:

1grep -rnE "httpsOptions|https\.createServer|http2\.create(Secure)?Server|http2: true" src/   # TLS or HTTP/2 inside Node?
2grep -rnE "flushHeaders\(|respondWith(File|FD)\(" src/   # handlers to read against the leak and file-serving bugs

Upgrading, from laptop to registry

If you moved to Lithium last week, you get to do it again.

Pin the patched floor where tooling reads it: .nvmrc takes one line, 26.13.1, and engines documents the minimum per line:

1{
2  "engines": {
3    "node": "^26.13.1 || ^24.22.3 || ^22.23.5"
4  }
5}

Containers are where stale runtimes hide. Bump the base image in every stage, following the official node:<version>-<variant> naming:

1 # Dockerfile
2-FROM node:26.13.0-slim AS build
3+FROM node:26.13.1-slim AS build
4 # build steps unchanged
5-FROM node:26.13.0-slim
6+FROM node:26.13.1-slim

Rebuild and check what the image ships:

1node --version   # local: v26.13.1, v24.22.3, v22.23.5 or later on that line
2docker build --pull --no-cache -t my-api:node-26.13.1 .
3docker run --rm --entrypoint node my-api:node-26.13.1 --version   # expect v26.13.1

CI should run the exact patched versions:

1jobs:
2  test:
3    runs-on: ubuntu-latest
4    strategy:
5      matrix:
6        node-version: ['22.23.5', '24.22.3', '26.13.1']
7    steps:
8      - uses: actions/checkout@v4
9      - uses: actions/setup-node@v4
10        with:
11          node-version: ${{ matrix.node-version }}
12      - run: node --version

These are patch releases, but per the 26.13.1 notes TLS resumption is now disabled for mTLS without a session ID context, and SNI can no longer change on renegotiation or resumption. Test mutual TLS handshakes after upgrading.

No workaround, and a crowded credits list

The advisory offers no workaround, only the upgrade. End-of-life lines are always affected and get no builds, so 20.x or 25.x means a major-version move. The November 4 pre-alert gave a week's notice.

Both headliners are reachable remotely without authentication, and Node rates both High. Rescana reports CVSS 3.0 scores of 8.1 and 8.2 from the OpenJS CNA, and found neither in CISA's Known Exploited Vulnerabilities catalog on November 12. The advisory says nothing about exploitation.

Chris Rohlf, working with Claude and Anthropic Research, reported five of the 16, both headliners included; Tim Perry reported three; Trail of Bits (OpenAI) is credited with one; Matteo Collina wrote 12 of the fixes.

The same day, Apache HTTP Server 2.4.71 fixed a Critical mod_http2 heap corruption and remote code execution bug, CVE-2026-119618, in 2.4.55 through 2.4.70, reported by Anthropic and Google. If httpd is your shield, it needs its own patch.

What we could not verify

• The third Low CVE. The advisory lists CVE-2026-106071, already fixed in October for 26.x; the release notes list CVE-2026-123873 instead. The count holds; your scanner's IDs may differ.
• The 22.x scope. The advisory excludes four CVEs (123863, 123874, 123828, 123868) from 22.x, yet the 22.23.5 notes fix them. Our 11 follows the advisory; the notes imply 15.
• Scores and exploitation status are Rescana's reading of CVE.org and CISA, not pages we opened. A KEV listing would raise urgency, not change the fix.
• Docker tags. node:26.13.1-slim follows the image's usual naming; we did not confirm it on Docker Hub.
• Framework internals. If Nest, Express or Fastify call res.flushHeaders() for you, the grep undercounts; we did not audit them.

The 30,000-foot read

A JavaScript runtime's network stack is C++ glue around nghttp2, llhttp and OpenSSL, and the glue is where memory bugs live. The finders now include AI labs: Anthropic appears in the credits of both Node's and Apache's advisories this week, OpenAI beside Trail of Bits in Node's. If the cadence is a guide, finding has become cheaper than fixing: ten fixes three weeks ago, sixteen now. Nobody reading this controls that curve.

What you control is shorter: where TLS and HTTP/2 terminate, how many places your Node version is written down, and how fast every image can be rebuilt. A team with a patched proxy, one pinned version and scheduled rebuilds turned this advisory into a quarter-hour chore. Watch for a correction to the advisory's Low list and 22.x scope, and do not assume the next release is three weeks away.

Sources: Node.js, Wednesday, November 11, 2026 Security Releases (16 CVEs, severities, affected lines, descriptions and preconditions, credits, dependency list, no workaround, EOL note); Node.js 26.13.1 release notes (fixed version, CVE-to-commit mapping, undici 8.12.4, brotli, llhttp and sqlite versions, TLS behaviour changes, release author); Node.js 24.22.3 release notes (fixed version, CVE list, undici 7.30.2); Node.js 22.23.5 release notes (fixed version, CVE list including four the advisory excludes from 22.x); Node.js, October 21, 2026 Security Releases (10 CVEs by severity, fixed versions, CVE-2026-106071); Node.js download archive (26.13.1 as latest LTS of the Lithium line); oss-security pre-alert (November 4 pre-announcement, lines 22, 24 and 26); Apache HTTP Server 2.4 vulnerabilities (2.4.71 release date, three CVEs, CVE-2026-119618 rating, affected versions, reporters); NestJS, HTTPS and multiple servers (httpsOptions, FastifyAdapter https option); NestJS, Performance (adapter options passed through to Fastify, imports); @nestjs/platform-fastify 11.1.19 type definitions (FastifyAdapter constructor accepts HTTP/2 secure options); Fastify HTTP2 reference (http2 and https options); Rescana (secondary: CVSS 3.0 scores from the OpenJS CNA records, CISA KEV absence as of November 12). Some early coverage centred on two CVEs; the release fixes 16, the advisory lists the HTTP/2 abort for 24.x and 26.x only, and no OpenSSL update ships. CAVEAT: the advisory and the release notes disagree on the third Low CVE (106071 versus 123873), on whether four CVEs affect 22.x, and on sqlite (the advisory lists it for 22.x and 24.x, the 26.13.1 notes bump it too); per-line counts are our tally of the advisory's affected-lines column; if the advisory is right, the November Low count includes one CVE first fixed in October; CVSS and KEV status are single-source via Rescana; Docker Hub tags were not checked directly; the October 28 LTS date comes from our own Node 26 coverage; the proxy and h2c exposure reasoning is our reading of the advisory's TLS and cleartext wording, not an official statement.