Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines.
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines.
A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections; fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1.
The advisory does not report any attacks using the flaws.
Five of the flaws, including CVE-2026-123863 and CVE-2026-123864, were reported by Chris Rohlf in collaboration with Claude and Anthropic Research, according to the advisory.
The crash flaw, CVE-2026-123863, needs only a default HTTP/2 server that replies before the request body has fully arrived.
On 22.x and older 24.x and 26.x builds, it can still be triggered when the server itself closes a stream partway through a response, for example after an idle timeout.
From 24.22.0 and 26.9.0 onward, a client alone can trigger it.
A separate flaw in Node.js HTTPS servers, CVE-2026-123864, can allow an unauthenticated client to read memory from other connections, the project says.
The release fixes 16 vulnerabilities in Node.js itself, seven of them rated high; updating to the fixed version for each line is the only fix in the project's security advisory.
End-of-life lines, including 20.x and 25.x, get no fix in this release, and the project says such versions are always affected.
It lists no workaround for servers that cannot update yet.
It also does not say whether servers that met the conditions for the HTTPS flaw should replace their TLS keys or other secrets after updating.
What happened
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines.
A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections; fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1.
What changed
The advisory does not report any attacks using the flaws.
Five of the flaws, including CVE-2026-123863 and CVE-2026-123864, were reported by Chris Rohlf in collaboration with Claude and Anthropic Research, according to the advisory.
Who is affected
The crash flaw, CVE-2026-123863, needs only a default HTTP/2 server that replies before the request body has fully arrived.
On 22.x and older 24.x and 26.x builds, it can still be triggered when the server itself closes a stream partway through a response, for example after an idle timeout.
Why it matters
From 24.22.0 and 26.9.0 onward, a client alone can trigger it.
A separate flaw in Node.js HTTPS servers, CVE-2026-123864, can allow an unauthenticated client to read memory from other connections, the project says.
Technical details
The release fixes 16 vulnerabilities in Node.js itself, seven of them rated high; updating to the fixed version for each line is the only fix in the project's security advisory.
End-of-life lines, including 20.x and 25.x, get no fix in this release, and the project says such versions are always affected.
Response
It lists no workaround for servers that cannot update yet.
What security teams should do
It also does not say whether servers that met the conditions for the HTTPS flaw should replace their TLS keys or other secrets after updating.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.