Node.js · Disclosed

Node.js fixes 16 flaws, including TLS key exposure

Nov 11, 2026 · 1 min read

Node.js released updates for 16 vulnerabilities, including seven high-severity flaws. CVE-2026-123864 may allow unauthenticated extraction of server memory under specific conditions, exposing TLS keys and other users' requests. Administrators should apply the security updates.

By HIFY Radar newsroom Updated 11/12/2026 06:11 AM Get this every day →← Back to the feed 2 sources

HighVulnerabilityDisclosedPatched

In 30 seconds

Alleged

Reports say Node.js has released versions 22.23.5, 24.22.3, and 26.13.1 to address 16 security flaws. The reported risks include HTTP/2 server crashes, disclosure of memory from other connections, and, under specific conditions, possible exposure of TLS private keys.

What happened

Alleged

The Hacker News reports that an unauthenticated client can trigger one flaw to crash servers using Node.js built-in HTTP/2 support on the 24.x and 26.x lines. It says a separate HTTP/2 flaw can make a server return fragments of its memory, potentially including responses meant for other connections.

Alleged

A separate account identifies CVE-2026-123864 as a memory-exposure flaw that could reveal sensitive server data, potentially including TLS private keys and other users' requests under particular conditions. The supplied evidence does not independently verify that outcome.

Why it matters

Inferred

A remotely triggered crash threatens availability, while cross-connection memory disclosure threatens confidentiality. If exposed memory contains private keys or another user's request, the consequences could extend beyond one failed connection, although the batch only presents those outcomes as possibilities under specific server conditions.

What to do

Inferred

Administrators running supported Node.js lines should identify the deployed version and plan an upgrade to 22.23.5, 24.22.3, or 26.13.1 as applicable. Systems exposing built-in HTTP/2 deserve particular attention because the reporting describes unauthenticated, remotely reachable failure modes there.

Confirmed and still uncertain

Observed

The evidence consistently names 16 patched vulnerabilities and the same three fixed releases. It does not include the official Node.js advisory, a complete affected-version matrix, proof-of-concept details, confirmation of exploitation in the wild, or the exact conditions required for possible TLS key exposure.

What people are saying

Observed

The Hacker News social account says seven flaws are rated high and highlights an HTTPS issue that could expose TLS private keys under specific conditions. DarkWebInformer similarly describes possible memory extraction and urges immediate upgrades, but these posts are summaries rather than independent technical validation.

Evolution

Alleged

The reported chain is straightforward: specially crafted unauthenticated traffic reaches affected Node.js networking code, then either crashes an HTTP/2 server or causes memory from another context to be returned. Fixed releases are now reported across all three supported lines, but the evidence does not reconstruct when the bugs were discovered or whether they share one root cause.

Reach

Observed

2 independent groups, 3 updates, and 73 engagements.

Technical detail

Alleged

The central technical distinction is between denial of service and unintended memory disclosure. One reported HTTP/2 flaw terminates the server, while another can place server-memory fragments into a response. A separate post associates CVE-2026-123864 with potentially sensitive memory, but the supplied material does not establish the precise mechanism or confirm that private keys are always reachable.

Sources and evidence

Observed

This evidence batch contains one news report and two X posts. The posts broadly repeat the report's patch count, fixed versions, and possible impacts, but no official Node.js bulletin, vulnerability record, patch diff, or exploitation telemetry is included, so detailed scope and severity claims remain third-party reporting.