Node.js 16 Vulnerabilities: HTTP/2 Flaws and Memory Leaks

Node.js fixed 16 vulnerabilities in its 22.x, 24.x, and 26.x branches, including several that allow unauthenticated clients to take down HTTP/2 servers or expose memory from other connections. The patches were released on November 11 in versions 22.23.5, 24.22.3, and 26.13.1.

The Node.js Project released security updates for all three active branches. The distribution of vulnerabilities across branches is not uniform: the list affects all 16 entries in the 24.x and 26.x branches, while 11 affect 22.x, according to the breakdown published by 窓の杜. Severity is distributed across seven high-, six medium-, and three low-severity flaws.

The greatest concentration is in the HTTP/2, HTTPS, and TLS server code included in Node.js. The risk depends on how the server is built: some flaws are triggered with a default configuration, while others require specific routes, callbacks, or methods. The patches also update dependencies such as llhttp, undici, and SQLite.

HTTP/2: from process crashes to response leaks

CVE-2026-123863 allows an unauthenticated client to crash the process through a default HTTP/2 server. It is enough for the server to respond before receiving the complete request body, a behavior the project describes as common. The attack works over both TLS and unencrypted connections and affects the 24.x and 26.x branches.

The problem occurs when an HTTP/2 session is closed: a stream can retain header buffers allocated by nghttp2 after being removed from the session's set of streams. When the session is destroyed, an internal check detects that the accounted memory is not zero and terminates the process. The project identifies this as a variant of CVE-2024-27983, whose earlier fix did not cover this case.

Another high-severity vulnerability, CVE-2026-123865, causes memory and file descriptors to be retained indefinitely. An attacker can initiate remote closure with a GOAWAY(NO_ERROR) message and then trigger a protocol error, for example with an oversized frame header. The session hangs and the socket remains in CLOSE_WAIT; the flaw affects all three active branches.

Data leaks also occur in CVE-2026-123866, a use-after-free when tearing down an HTTP/2 stream. If a write remains blocked by backpressure when the stream is destroyed—for example, after a client RST_STREAM or a server timeout—the socket may send freed memory instead of the intended response. That memory may include response buffers from other connections.

In the 24.x and 26.x branches, a client can trigger the flaw on its own following the window-size changes introduced in 24.22.0 and 26.9.0. In all three branches, it can also be reached if the application destroys the stream, for example when its idle timeout expires.

CVE-2026-123874 allows memory corruption on the server when it serves files using stream.respondWithFile() or stream.respondWithFD(). If the client resets the stream while a write is still queued, the object may be freed before the operation completes and then used as if it were still valid. The flaw affects the 24.x and 26.x branches, both with TLS and without encryption. A related issue, CVE-2026-123875, can take down all three branches if a client cancels a download served with these methods.

HTTPS and TLS can also expose data

On HTTPS servers, CVE-2026-123864 allows an unauthenticated client to read memory belonging to other connections. The Node.js Project warns that this may include TLS private keys and other users' requests. For the conditions to be met, the handler must call res.flushHeaders() before the body has finished arriving and then call res.end() with data; a route that returns or stores request bodies is also required to obtain the leaked memory.

The flaw stems from a zero-length TLS write re-entering the HTTP parser while it is processing the body. This reentrancy causes a use-after-free and an out-of-bounds heap read, which the server may copy into the response to that request. It affects all three active branches; unencrypted HTTP servers created with node:http are not affected.

Another high-severity flaw, CVE-2026-123872, affects TLS servers that apply different client certificate requirements depending on the hostname. During TLS 1.2 renegotiation, a client authenticated for an allowed host can change the server name and carry that authentication over to a host with stricter rules. All three active branches are affected.

In the 24.x and 26.x branches, CVE-2026-126051 allows a TLS server to be taken down if it uses the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or the server.addContext() method. The problem lies in deferred callbacks that do not account for the socket being destroyed before they run. The project describes a sequence in which a ClientHello and socket closure occur in the same cycle, causing an uncaught exception.

There are two other bypasses in TLS configuration. CVE-2026-123867 may allow a certificate accepted by the default certificate authority to reach a host that was supposed to require a different CA, when an SNI context is configured to set only the CA and not a server certificate. CVE-2026-123877, by contrast, affects https.Agent: a stored TLS session with a broader trust policy can be reused in a subsequent request with a stricter policy. Both flaws affect all three active branches.

Memory, credentials, and permissions

The set also includes a medium-severity flaw, CVE-2026-123868, which allows memory exhaustion in HTTP/2 servers in the 24.x and 26.x branches. Incoming data left in a stream's read queue is not counted against the session budget. The project explains that an attacker can send around 10 bytes per frame while the server retains about 114 bytes; in this way, tens of megabytes sent can turn into hundreds of megabytes retained. The maxSessionMemory limit does not stop this growth.

There is also a one-byte overflow in session.altsvc() (CVE-2026-123828), in the 24.x and 26.x branches, when the application supplies a long, attacker-controlled origin. The error can corrupt memory and abort the process. In all three branches, CVE-2026-123871 exposes proxy credentials in ERR_PROXY_INVALID_CONFIG messages: some error paths included the full URL, with username and password, in messages that may end up in stderr, container logs, or crash-reporting services.

The three low-severity flaws complete the tally. CVE-2026-123829 may reveal file and directory names that the process does not have permission to read when recursive fs.watch() is used on macOS or Windows. The list from 窓の杜 also includes CVE-2026-123862, a zlib issue in which combining a pending call to params() with destroy() causes an uncapturable internal error, and CVE-2026-106071, described as an excessive grant of filesystem permissions through a wildcard radix search.

Dependency updates accompany the Node.js patches. 窓の杜 details llhttp 9.4.4 for the 22.x, 24.x, and 26.x branches; undici 8.12.4 and 7.30.2 for 26.x and 24.x; SQLite 3.54.1 for all three branches; and Brotli 1.2.1 for 24.x and 26.x. The Node.js Project mentions updates to llhttp, undici, and SQLite without including those version numbers in its notice.

The patches do not cover unsupported branches

The fixed versions are 22.23.5, 24.22.3, and 26.13.1. Heroku announced that it made them available for builds on its platform on November 11. The Node.js Project notice states that unsupported branches, including 20.x and 25.x, are not receiving fixes in this release and remain affected.

The project says that updating to the fixed version for each branch is the only solution included in its notice: it offers no temporary mitigation for servers that cannot yet do so. It also does not report any attacks exploiting these vulnerabilities or specify whether servers that may have exposed TLS keys or other secrets should replace them after updating.

Sources: The Hacker News, Node.js Project, OpenJS Foundation CVE Numbering Authority, 窓の杜, Heroku Dev Center