Node.js Patches 11 Vulnerabilities, Including High-Severity DoS and Filesystem Bypass Flaws
Node.js has released critical security updates addressing 11 vulnerabilities across its active branches, including two high-severity flaws that could lead to denial-of-service conditions and bypass filesystem restrictions.
The Node.js project has issued urgent security updates for its 22.x, 24.x, and 26.x active release lines, patching a total of 11 vulnerabilities. These fixes are available in Node.js versions v22.23.2, v24.18.1, and v26.5.1, respectively. The July 2026 security release addresses a range of issues, including critical flaws in HTTP/2 processing, the Permission Model, and vulnerabilities affecting HTTPS, DNS resolution, SQLite handling, Zlib APIs, and HTTP request smuggling.
Two high-severity vulnerabilities within the HTTP/2 processing component pose significant risks. CVE-2026-56846 allows attackers to bypass the maxSessionMemory limit by sending specially crafted HTTP/2 traffic that exhausts server memory, leading to a denial-of-service (DoS) condition. Complementing this, CVE-2026-56848, also a high-severity issue, can trigger a heap use-after-free vulnerability in the underlying nghttp2 library when it processes data concurrently with receiving additional data. Such memory corruption bugs can lead to process crashes and potentially more severe security implications.
A critical vulnerability in the Node.js Permission Model, tracked as CVE-2026-58043, presents a serious risk to applications utilizing the --permission flag. This flaw can mistakenly grant filesystem access beyond the intended allowlist due to issues in radix-tree prefix boundary handling. Attackers could exploit this to read or write files in unintended locations, compromising data integrity and confidentiality.
The update also rectifies several medium-severity vulnerabilities. CVE-2026-56850 addresses a flaw where HTTPS Agents might reuse mutual TLS identities across requests involving different PFX certificates. Additionally, CVE-2026-58040 corrects an incomplete patch that could allow TLS session reuse to bypass hostname verification across identity policies, potentially enabling man-in-the-middle attacks.
Further fixes include addressing issues that could lead to application crashes. CVE-2026-58042 prevents dns.resolveAny() from aborting when encountering DNS responses with more than 256 A records. Similarly, CVE-2026-58045 resolves a crash in synchronous Node:zlib APIs that could be triggered by spoofed TypedArray lengths.
Lower-severity vulnerabilities related to the Permission Model have also been patched. CVE-2026-56847 and CVE-2026-58039 could allow attackers to write files outside of paths permitted by --allow-fs-write by bypassing allowlists for trace event logs and process reports, respectively.
Finally, CVE-2026-58044 resolves an issue with HTTP header truncation that could enable request smuggling attacks in Node.js-based forwarding proxies. Administrators are strongly advised to upgrade to the latest patched versions immediately to mitigate these risks. Users of unsupported Node.js versions remain vulnerable to disclosed security flaws.