Node.js Patches 16 Vulnerabilities, Including TLS Private Key Exposure and Remote Crash Flaws
Node.js has released critical security updates addressing 16 vulnerabilities, with high-severity flaws capable of exposing TLS private keys and causing remote server crashes.
The Node.js project has issued urgent security updates for its 22.x, 24.x, and 26.x release lines, patching a total of 16 vulnerabilities. Of these, seven are classified as high severity, six as medium, and three as low. The patched versions are v22.23.5, v24.22.3, and v26.13.1. This update also includes refreshed versions of three bundled components: llhttp, undici, and sqlite.
A particularly concerning high-severity flaw, CVE-2026-123864, resides within the HTTPS code. This vulnerability allows an unauthenticated client to read memory from other active connections. Crucially, this exposed memory can contain sensitive information such as TLS private keys and other users' request data. The issue stems from a re-entry problem in the HTTPS handling, where a zero-length TLS write can cause Node.js to decrypt the subsequent record while the HTTP parser is still processing the current body. This leads to a use-after-free condition and an out-of-bounds read, resulting in old heap memory being copied into the request body. Exploitation is possible if a server handler calls res.flushHeaders() prematurely and later sends a non-empty chunk, especially in routes that echo or store request bodies.
The HTTP/2 implementation is the source of several other critical vulnerabilities. CVE-2026-123863, a variant of a previously patched flaw, allows any client to trigger a session teardown and crash a default HTTP/2 server. Additionally, CVE-2026-123874 and CVE-2026-123875 affect servers using the respondWithFile() function. One corrupts memory, while the other can crash the server with just a few canceled download requests. CVE-2026-123866 enables the sending of freed response memory to a peer, potentially exposing other users' data, and CVE-2026-123865 leads to a permanent leak of memory and file descriptors following a protocol error during shutdown.
Several medium-severity flaws also pose significant risks. CVE-2026-123868 allows a client to send minimal one-byte frames, causing the server to retain approximately 114 bytes for every 10 bytes sent, leading to potential memory exhaustion as a single stream could consume hundreds of megabytes. Another medium-severity issue, CVE-2026-123828, involves a one-byte heap overflow in the session.altsvc() function, which can cause the process to abort if an application passes a lengthy :authority value.
Beyond these, the updates address vulnerabilities impacting authentication and certificate validation. CVE-2026-123872 permits a client to alter the server name during TLS 1.2 renegotiation, potentially bypassing client certificate checks for hosts requiring stricter authentication. Similarly, CVE-2026-123867 allows a fallback to the default Certificate Authority (CA) when a host is configured with only a specific CA, enabling unauthorized access. CVE-2026-123877, affecting https.Agent, allows the reuse of a TLS session across different CA policies, leading to incorrect authorization.
Other vulnerabilities include the exposure of proxy credentials in error messages (CVE-2026-123871), memory and file descriptor leaks during HTTP/2 session shutdown (CVE-2026-123865), and issues with the Permission Model and zlib library that could lead to file name leaks or unintended file system access (CVE-2026-123829, CVE-2026-106071).
These vulnerabilities were reported by various researchers, including Chris Rohlf in collaboration with Claude and Anthropic Research, as well as independent researchers and firms like Trail of Bits. Matteo Collina was instrumental in fixing many of these issues. This release follows a pattern of frequent security updates for Node.js, underscoring the ongoing need for vigilance and timely patching in the Node.js ecosystem.
Given the severity of the flaws, particularly those affecting TLS private keys and server stability, administrators of public-facing HTTP/2 and HTTPS servers should prioritize updating to the patched versions immediately. For those running vulnerable HTTPS handlers, it is strongly recommended to consider rotating TLS private keys, as memory leaks can leave no direct trace of compromise. Rebuilding container images to include the updated runtime is also a crucial step in securing deployments.