Vulnerabilities · 17h ago

Node.js flaws put server memory and uptime at risk

The Node.js project has patched 16 flaws across its supported 22.x, 24.x and 26.x lines, including unauthenticated server crashes and memory leaks. Fixed releases are 22.23.5, 24.22.3 and 26.13.1.

Some bugs let a client make a server return fragments of process memory belonging to other connections. In HTTPS, a particular pattern of handling request bodies and sending responses can expose other users’ requests or TLS private keys; HTTP/2 flaws can also crash servers or tie up resources.

For teams running Node.js directly on internet-facing HTTP/2 or HTTPS services, these fixes address confidentiality as well as uptime. Node.js 20.x and 25.x are end of life and receive no fixes in this release, while any data or keys already exposed would remain exposed after an upgrade.

CVEs in this update

15 CVEs

Across node.

0 critical · 7 high · 6 medium · 2 low

0 in CISA KEV · 0 with EPSS above 1%

Highest severity: CVE-2026-123863 · 8.2 HIGH

Showing the top 10 by KEV, EPSS, and severity.

Timeline

• Nov 12 Reported by NCSC-NL Advisories

Sources

2 sources covering this story

• NCSC-NL Advisories Nov 12

  Kwetsbaarheden verholpen in Node.js

  Verschillende kwetsbaarheden in Node.js kunnen leiden tot informatielekken, geheugenfouten en serveruitval.

• The Hacker News Nov 12

  Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

  Node.js fixed 16 vulnerabilities across three supported lines, including HTTP/2 server crashes and HTTPS memory disclosure.

Entities

• CVE-2026-123828
• CVE-2026-123863
• CVE-2026-123864
• CVE-2026-123865

Part of the PlainSec briefing for 2026-11-13

Editions

• Briefing for 2026-11-13

Related stories

• GPUStack's localhost spoofing skips authentication on exposed managers
• Quay signing flaw lets attackers mint registry-wide tokens
• XWEB EVO configuration flaw exploited within 100 minutes