Node.js Fixes HTTP/2 and HTTPS Flaws That Can Crash Servers or Leak Memory
Summary
Node.js fixed 16 vulnerabilities, including flaws that let unauthenticated clients crash qualifying HTTP/2 servers or read memory from other connections. Fixes are available in 22.23.5, 24.22.3 and 26.13.1; no workaround is listed.
Key points
- CVE-2026-123863 can crash a default HTTP/2 server that responds before the request body has fully arrived; the flaw can be triggered over TLS or cleartext.
- CVE-2026-123866 can expose memory from other connections. The triggering conditions vary by Node.js release line and version.
- CVE-2026-123864 affects HTTPS servers when a handler flushes headers before the request body arrives and later ends the response with data; leaked memory may include TLS private keys and other users’ requests.
- Fixed versions are 22.23.5, 24.22.3 and 26.13.1. The HTTPS flaw does not affect plain HTTP servers built with node:http.
- The release fixes 16 Node.js vulnerabilities, seven rated high. The advisory lists updating to a fixed version as the only fix and provides no workaround.
- End-of-life 20.x and 25.x lines receive no fix and are described by the project as always affected.
- The advisory reports no attacks exploiting the flaws and does not say whether affected servers should replace TLS keys or other secrets after updating.
Article Details
- Vulnerability Types
- HTTP/2 server crash
- HTTP/2 cross-connection memory disclosure
- HTTPS cross-connection memory disclosure
- Affected Versions
- Node.js 22.x
- Node.js 24.x
- Node.js 26.x
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-123863nodejs · nodeThe crash flaw, CVE-2026-123863, needs only a default HTTP/2 server that replies before the request body has fully arrived. The Node.js project calls that behavior typical. The crash works over both TLS and cleartextCVE-2026-123864Vendor / Product unavailableA separate flaw in Node.js HTTPS servers, CVE-2026-123864, can allow an unauthenticated client to read memory from other connections, "including TLS private keys and other users' requests," the project says. It affectsCVE-2026-123866Vendor / Product unavailableThe memory flaw, CVE-2026-123866, affects all three lines. From 24.22.0 and 26.9.0 onward, a client alone can trigger it. On 22.x and older 24.x and 26.x builds, it can still be triggered when the server itself closes a