A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime’s built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections.
Fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1.
The crash flaw, CVE-2026-123863, needs only a default HTTP/2 server that replies before the request body has fully arrived. The Node.js project calls that behavior typical. The crash works over both TLS and cleartext connections.
The memory flaw, CVE-2026-123866, affects all three lines. From 24.22.0 and 26.9.0 onward, a client alone can trigger it. On 22.x and older 24.x and 26.x builds, it can still be triggered when the server itself closes a stream partway through a response, for example after an idle timeout.
A separate flaw in Node.js HTTPS servers, CVE-2026-123864, can allow an unauthenticated client to read memory from other connections, “including TLS private keys and other users’ requests,” the project says. It affects all three supported lines.
The flaw needs a handler that calls res.flushHeaders() before the request body has fully arrived and later calls res.end() with data. Reading the leaked memory also needs a route that sends back or stores a request body. Plain HTTP servers built with node:http are not affected.
The release fixes 16 vulnerabilities in Node.js itself, seven of them rated high. The other four high-rated flaws, and the servers they affect, are:
- CVE-2026-123865: a client can make any default HTTP/2 server hold memory and file descriptors permanently, on all three lines.
- CVE-2026-123874: a client can corrupt server memory on 24.x and 26.x when the server serves files with stream.respondWithFile() or stream.respondWithFD(). On all three lines, canceling such downloads can also crash the server (CVE-2026-123875, rated medium).
- CVE-2026-126051: a client can crash a TLS server on 24.x and 26.x if the server uses the SNICallback, OCSPRequest, newSession or resumeSession hooks, or server.addContext().
- CVE-2026-123872: on a TLS server with stricter client-certificate rules for some hostnames, a client approved for another hostname can switch to a stricter one during TLS 1.2 renegotiation without meeting its rules. All three lines are affected.
The eight flaws above are all in Node.js’s own HTTP/2, HTTPS and TLS server code, so they matter where a Node.js process accepts those connections itself.
Updating to the fixed version for each line is the only fix in the project’s security advisory. It lists no workaround for servers that cannot update yet.
End-of-life lines, including 20.x and 25.x, get no fix in this release, and the project says such versions are always affected.
The advisory does not report any attacks using the flaws. It also does not say whether servers that met the conditions for the HTTPS flaw should replace their TLS keys or other secrets after updating.
Five of the flaws, including CVE-2026-123863 and CVE-2026-123864, were reported by Chris Rohlf in collaboration with Claude and Anthropic Research, according to the advisory.
