Do Son 
TL;DR
Node.js shipped fixes for 11 vulnerabilities on 29 July 2026. Three are rated high severity, and the rest are medium or low. The updates cover the 26.x, 24.x, and 22.x release lines. No in-the-wild exploitation has been confirmed.
Why it matters
Node.js runs a huge share of the world’s backend services. So even a memory bug can expose many production servers. These Node.js vulnerabilities touch HTTP/2, TLS, the Permission Model, and several core modules.
None require exotic access. Most affect default features that busy web servers use every day. That broad reach is what makes this batch worth prompt attention.
How the attacks work
The three high-severity issues stand out. CVE-2026-56848 is a heap use-after-free in HTTP/2 handling. A re-entrant send call during receive processing triggers it.
CVE-2026-56846 lets retained HTTP/2 header blocks slip past the maxSessionMemory limit. That can drive remote memory exhaustion. Meanwhile, CVE-2026-58043 weakens the Permission Model, over-granting filesystem access across radix-tree prefix boundaries.
Medium and low-severity bugs
Several medium flaws affect TLS and core modules. One HTTPS Agent bug can reuse mTLS client identities across certificates. Another can skip hostname verification, extending an incomplete fix for an earlier CVE. Denial-of-service bugs also hit the dns and zlib modules.
Three low-severity Node.js vulnerabilities round out the set. Two let the Permission Model write outside its allowlist. The third truncates HTTP headers, which could hide a Content-Length and enable request smuggling through forwarding proxies.
Affected versions
The flaws span the active 26.x, 24.x, and 22.x lines, though coverage varies per CVE. End-of-life versions stay affected, since they receive no patches. Node.js urges everyone to run a current release.
Patch and mitigation
Update now. The fixes ship in v22.23.2, v24.18.1, and v26.5.1. The release also refreshes the bundled undici and llhttp dependencies.
For the full technical breakdown, read the official Node.js advisory. No public proof-of-concept or in-the-wild exploitation has been confirmed.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
