Node.js HTTP/2 and TLS Memory Leak Flaws Fixed in 26.13.1, 24.22.3 and 22.23.5

TL;DR

The Node.js project shipped security releases 26.13.1, 24.22.3 and 22.23.5, fixing 17 vulnerabilities. Seven are rated high, and most of them are Node.js HTTP/2 vulnerabilities that let an unauthenticated client crash a server or leak memory. The worst HTTPS bug can expose “TLS private keys and other users’ requests” to an attacker.

Remote clients could crash Node.js servers, leak heap memory or bypass client-certificate checks over HTTP/2 and TLS. The fixes cover all active release lines. Upgrade to 26.13.1, 24.22.3 or 22.23.5 and restart your services.

Notable CVEs

Why It Matters

Many of these bugs need no login and work against default settings. For instance, one HTTP/2 crash “needs only a default http2 server whose handler responds before the request body has ended, which is typical.” As a result, a single client can take down an API or website.

The memory leaks are more serious. An attacker could read data that belongs to other users or to the server itself. So far, the Node.js team has not reported any attacks, and no public exploit has surfaced. None of these CVEs is in CISA’s Known Exploited Vulnerabilities catalog.

How the Attack Works

HTTPS heap leak (CVE-2026-123864)

A zero-length TLS write made inside the HTTP parser’s body callback makes Node.js decrypt the next TLS record too early. This re-enters the parser and causes a use-after-free and an out-of-bounds read. The server then copies “freed or unrelated heap memory” into the request body. However, it needs a handler that flushes headers early and later ends the response with data. Cleartext node:http is not affected.

HTTP/2 crashes and leaks

Several Node.js HTTP/2 vulnerabilities target how sessions and streams shut down:

• CVE-2026-123863: A stream outlives its session, so a memory check fails and the process aborts.
• CVE-2026-123865: A protocol error during shutdown leaves sessions in memory forever, leaking memory and file descriptors.
• CVE-2026-123866: Stream teardown during a backpressured write sends freed memory, including other connections’ responses, to the peer.
• CVE-2026-123874: Resetting a respondWithFile() stream during a pending write corrupts server memory.
• CVE-2026-123828 and CVE-2026-123875: A long :authority value in Alt-Svc handling, or a cancelled file download, can crash the server.
• CVE-2026-123868: Data queued on an undrained stream escapes the maxSessionMemory limit. A small amount of traffic can tie up hundreds of megabytes.

TLS and certificate bypasses

Meanwhile, CVE-2026-123872 lets a client change the servername during TLS 1.2 renegotiation. As a result, it can carry its login to a host with a stricter client-certificate policy. CVE-2026-123867 makes a CA-only SNI context fall back to the default client CA. In addition, CVE-2026-123877 lets https.Agent reuse a TLS session across two different CA policies. Finally, CVE-2026-126051 lets a client crash TLS servers that use SNI, OCSP or session hooks.

Lower-severity fixes

The release also stops proxy credentials from leaking into error messages. It fixes two Permission Model gaps and a zlib crash as well.

Who Found the Bugs

Chris Rohlf reported five of the issues “in collaboration with Claude and Anthropic Research.” Trail of Bits, pimterry and other researchers reported the rest. Matteo Collina wrote most of the fixes.

Affected Versions

• Node.js 26.x before 26.13.1
• Node.js 24.x before 24.22.3
• Node.js 22.x before 22.23.5

Some HTTP/2 and TLS bugs affect only the 24.x and 26.x lines. The release also updates llhttp, undici and SQLite.

Patch and Mitigation

Install the patched release for your line, then restart every Node.js process. Rebuild container images and single executable applications too. Until you can patch, consider putting HTTP/2 services behind a proxy that terminates HTTP/2. Also review any server that uses per-host client-certificate rules.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.