Node.js November 11 Security Release Explained: HIGH Fixes for 22, 24 and 26 — What to Do Today

on

nodejs november 11 security release explained — the Node.js logo

Image: Node.js logo, via Wikimedia Commons (Ryan Dahl, MIT licence) — the official Node.js project visual.

Update — 14 November 2026: The release has shipped. Node.js published the patched builds on Wednesday, 11 November 2026 — 22.23.5, 24.22.3 and 26.13.1 — fixing 16 vulnerabilities, seven rated HIGH. The worst flaw, CVE-2026-123864, can leak memory from other connections, including TLS private keys. If you run Node.js 22, 24 or 26, update now and restart the process — there is no workaround. The full flaw list is in the new section below.

TL;DR: Node.js November 11 security release explained in one line: the patched builds — 22.23.5, 24.22.3 and 26.13.1 — shipped on Wednesday, 11 November 2026, fixing 16 vulnerabilities, seven rated HIGH, including an HTTPS flaw that can leak TLS private keys and HTTP/2 flaws that let an unauthenticated client crash a server. Update to your line's fixed build and restart the process — there is no workaround.

Key Highlights

  • The release shipped on Wednesday, 11 November 2026 — fixed builds 22.23.5, 24.22.3 and 26.13.1, one per supported line (26.x, 24.x and 22.x).
  • 16 vulnerabilities fixed: 7 HIGH, 6 medium and 3 low — most of them in the HTTP/2, HTTPS and TLS server code that public-facing Node.js servers depend on.
  • Worst flaw: CVE-2026-123864 (HIGH) — an unauthenticated client can read memory from other connections, including TLS private keys and other users' requests. It needs a handler that calls res.flushHeaders() before the request body ends.
  • Five of the 16 flaws were reported by security researcher Chris Rohlf working with Claude and Anthropic Research — including CVE-2026-123863 and CVE-2026-123864.
  • No exploitation reported, and no workaround — updating to the fixed build for your line is the only fix. Node.js 20 and 25 get nothing: end-of-life versions are always affected, and receive no new builds.
  • October's release is the warning: three weeks earlier the same three lines got 10 fixes, including Node2Shell (CVE-2026-111497), a Brotli flaw that can lead to remote code execution — and CISA's patching deadline for it was 10 November.

What happened?

The Node.js project published advance notice of its November security release on 3 November 2026, and followed it with a pre-alert to the oss-security mailing list on 4 November. The notice is short, and its wording matters, so here it is in full: the project "will release new versions of the 26.x, 24.x, 22.x releases lines on or shortly after, Wednesday, November 11, 2026" — and "the highest severity issue fixed in this release is HIGH", repeated separately for each of the three lines.

That was everything the project had said at the time. There was no list of vulnerabilities, no CVE identifiers, no count of how many issues were fixed, no named components and no fixed version numbers yet. That silence was deliberate, not an oversight: under the Node.js security policy, technical details stay private until the patched builds are out, so attackers cannot work from the announcement while defenders are still preparing. The details appeared on the same advisory page when the releases landed — see the update box above and the new section below — and through the low-volume, announcement-only nodejs-sec mailing list.

One phrase deserves attention: "on or shortly after". Wednesday 11 November was a target, not a guaranteed publication time. Past releases have slipped by a day — the June release was announced for 17 June and shipped on 18 June, and the July release was postponed twice. In the end the November builds landed on schedule, on Wednesday itself.

nodejs november 11 security release explained: which versions get patched

Three release lines get new builds. Two do not — and the gap between them is the most important part of this release for anyone running older Node.js.

Release lineStatusFixed build — 11 November 2026Support ends
26.x "Lithium"Active LTS since 28 October 202626.13.130 April 2029
24.x "Krypton"Maintenance LTS since 20 October 202624.22.330 April 2028
22.x "Jod"Maintenance LTS22.23.530 April 2027
20.x "Iron"End of life since 30 April 2026No — affected, no fix comingEnded 30 April 2026
25.xEnd of life since 1 June 2026No — affected, no fix comingEnded 1 June 2026

Node.js 26 became the Active LTS line on 28 October 2026, when 26.13.0 was released — read our explainer on Node.js 26 becoming the Active LTS line on 28 October. If you are setting up a new service, 26.x is the line to pick; 24.x is the fastest safe exit from an end-of-life version, since it is supported until April 2028.

For teams on Node.js 20, the message is blunt. The project stopped maintaining the line on 30 April 2026, and its own advisory warns that "end-of-life versions are always affected when a security release occurs". Three security releases have shipped since then, none of them with a 20.x build. The only routes off 20 are a move to 24 or 26, or commercial extended support through the OpenJS Foundation's Ecosystem Sustainability Program. That migration is a bigger job than a patch, which is exactly why the pre-announcement exists: it gives teams a week to find their exposure before the details go public.

nodejs november 11 security release explained — code on a computer monitor, illustrating the developer workflow around a patch day

Illustrative image: code on a monitor. Image: Wikimedia Commons / Markus Spiske, CC0 — the patch-day work is checking versions and rebuilding, not reading the code.

What the release actually fixed: the 16 CVEs

The builds landed on schedule on Wednesday, 11 November 2026, and the advisory was updated the same afternoon with the full list: 16 vulnerabilities in Node.js itself — 7 high, 6 medium and 3 low. Most of the high-rated flaws sit in the HTTP/2, HTTPS and TLS server code, so they matter wherever a Node.js process accepts those connections itself. The releases also update the bundled llhttp (9.4.4), SQLite (3.54.1), Undici and Brotli libraries.

CVESeverityWhat it doesLines
CVE-2026-123864HighHTTPS memory leak: a zero-length TLS write re-enters the HTTP parser, and the server can copy memory from other connections — including TLS private keys and other users' requests — into a response. Needs a handler that calls res.flushHeaders() before the body ends, plus a route that echoes or stores request bodies.22, 24, 26
CVE-2026-123863HighHTTP/2 crash: any unauthenticated client can abort a default HTTP/2 server that replies before the request body has fully arrived — a pattern Node.js itself calls typical.24, 26
CVE-2026-123865HighHTTP/2 resource leak: a client can make the server hold memory and file descriptors permanently — sockets stuck in CLOSE_WAIT, with no further cost to the attacker.22, 24, 26
CVE-2026-123866HighHTTP/2 use-after-free: freed response memory, including other connections' response buffers, can be sent to a peer when a stream is torn down mid-write. On 24.22.0 and 26.9.0 onward, a remote peer alone can trigger it.22, 24, 26
CVE-2026-123874HighHTTP/2 memory corruption when the server serves files with stream.respondWithFile() or stream.respondWithFD().24, 26
CVE-2026-123872HighTLS client-certificate bypass: a client can change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorised for, carrying its existing authentication to a host with a stricter policy.22, 24, 26
CVE-2026-126051HighTLS handshake crash: a deferred-callback use-after-destroy lets a remote, unauthenticated client terminate a server that uses SNICallback, OCSP or session hooks.24, 26

The other nine are lower rated but not trivial. CVE-2026-123868 (medium) lets an unauthenticated HTTP/2 client exhaust server memory, because data queued on an undrained stream is charged to no session budget. CVE-2026-123871 (medium) prints raw proxy URLs — username and password included — in ERR_PROXY_INVALID_CONFIG error messages, which can land in logs and crash reports. CVE-2026-123875 (medium) crashes a server when a client cancels a file download, and CVE-2026-123862 (low) lets a peer crash a process by disconnecting mid-compression in the zlib streaming API.

Five of the 16 flaws — including CVE-2026-123863 and CVE-2026-123864 — were reported by security researcher Chris Rohlf "in collaboration with Claude and Anthropic Research", according to the advisory itself. It is a concrete case of AI-assisted vulnerability research finding real flaws in a core runtime, not a lab demo: the same tools that write the code are now finding the bugs in it.

Two things the advisory does not do: it reports no exploitation of any of the 16 flaws, and it lists no workaround for servers that cannot update yet. Updating to the fixed build for your line is the only fix the project offers. The advisory also says nothing about whether servers that matched the CVE-2026-123864 handler pattern should rotate TLS keys after patching — patching closes future exposure, but it cannot un-leak a key, so treat rotation as a decision for your team.

Why October's release is the warning

The November release does not arrive in isolation. On 21 October 2026 the same three lines received security releases fixing 10 issues, with the highest severity again rated HIGH. The fixed builds were 22.23.4, 24.22.1 and 26.12.1, and the batch is a useful guide to what "HIGH" means in Node.js terms — because one of its flaws was genuinely dangerous.

The headline flaw was Node2Shell, tracked as CVE-2026-111497. A flaw in the Brotli decoder bundled with Node.js let malformed compressed input write past the end of an internal decoder buffer. An attacker who could supply Brotli data that an application decompresses with node:zlib could corrupt process memory — which, in the project's own words, "can lead to a crash, disclosure of process memory, or remote code execution". The flaw was already being targeted in the wild within days: CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October, with a federal remediation deadline of 10 November. Our post on Cisco's products hit by the October Brotli flaw covers the enterprise side, including Catalyst Center, Duo and Webex fixes.

The rest of the October batch shows how wide a Node.js security release reaches. Two flaws sat in TLS hostname verification — one let certificates with fullwidth-digit IP spellings authenticate connections they should not have, the other let leading-zero IP spellings such as 0127.0.0.1 validate against a certificate issued for a different address. A DNS flaw let hostnames containing a NUL byte be silently truncated, so an application validating one hostname could resolve another. An HTTP Agent flaw could mix up responses between requests reusing a connection. A crypto flaw could leak predictable UUIDs and random integers from snapshot-built apps. A zlib flaw could make a ZIP reader return bytes from the wrong entry. And two flaws sat in the permission model, letting restricted code read paths outside its allowed directories. Dependency updates for c-ares, OpenSSL, SQLite, Undici and the eMudhra certificate bundle rode along with the same release.

None of that told us in advance what the November flaws would be — and it would have been wrong to assume they were the same kind. But it does tell you what is at stake when a HIGH-rated Node.js release lands: the flaws in this class touch networking, TLS, compression and the permission model, and they have repeatedly turned out to be exploitable in real deployments. The gap between the announcement and the fix was the window to prepare, not a reason to wait — and as the section above shows, the November flaws turned out to be in exactly the same class: HTTP/2, HTTPS and TLS.

Why it matters for Indian developers

Node.js runs a large share of India's web backends — startup APIs, SaaS products, payment and logistics services, and the internal tools of bigger companies. The typical exposure is not one server: it is a spread of versions across laptops, CI runners, Docker base images and cloud instances, some of which nobody has inventoried since the project was set up. A security release that covers three lines at once is designed for exactly that spread, and this release is the moment to count it — and to patch it.

There is also a wider patch week under way. Go's 12-fix security release landed the same week, and 10 November was also the day .NET 8 and .NET 9 reached end of support as .NET 11 launched. If your stack mixes Node.js with Go services or .NET workloads, the same inventory exercise covers all three — and the same lesson applies to all of them: unsupported runtimes do not get fixes, whatever the next advisory says.

One longer change is worth knowing about while you plan. From the 27.x line, Node.js is moving to one major release a year, with every release becoming LTS — 27.0.0 arrives in April 2027 and enters LTS in October 2027. The odd/even era, in which odd-numbered lines never became LTS, ends with Node.js 26. That makes the 24-to-26 move a stable place to land: 26.x is supported until April 2029, and the next migration after it is two years away.

Should you care?

✅ Yes, if you run Node.js 22, 24 or 26 anywhere — the HIGH-rated fix has shipped. Update to 22.23.5, 24.22.3 or 26.13.1 now, then restart the process: installing the new binary does nothing until the old one stops.

✅ Yes, urgently, if you are still on Node.js 20 or 25 — this release will not patch you, and neither will the next one. Start the migration to 24 or 26 this week.

⏳ Not yet, if you do not run Node.js at all — nothing in this release touches your stack. But if your vendors or dependencies do, their patch notes are worth a glance now that the builds are out.

What to do now — the release has landed

The details are public now. Do this in order:

  1. Update to the fixed build for your line — 22.23.5, 24.22.3 or 26.13.1 — and restart the process. Installing the new binary does nothing until the old process stops. Use your usual route — OS package manager, nvm install 24.22.3 (or 22.23.5, or 26.13.1), the installer from nodejs.org, or a new Docker base image — then rebuild and redeploy anything that pins a Node version.
  2. Inventory first if you have not already. Run node -v on every server, laptop and CI runner, and check the base images of your Dockerfiles and the Node version pinned in your GitHub Actions or other CI configs. Write the list down — the zemna.net guide to this release puts it well: the work is knowing where your version lives before you know the CVEs.
  3. Check October first. If anything is still below 22.23.4, 24.22.1 or 26.12.1, it is missing the October fixes including Node2Shell — the November builds include everything, so one update to 22.23.5, 24.22.3 or 26.13.1 covers both.
  4. Consider TLS key rotation. If a server matched the CVE-2026-123864 handler pattern — res.flushHeaders() before the body ends, plus a route that echoes or stores request bodies — the advisory does not say whether to rotate its keys. Updating closes future exposure; it cannot un-leak a key, so treat rotation as a decision for your team.
  5. Subscribe to nodejs-sec. The low-volume announcement-only mailing list carries the notice the moment a security release publishes, with the full issue list and download links.
  6. If you are on 20 or 25, start the migration. Move to 24.x for the fastest safe exit, or 26.x for the longest support. Test on a branch first; the jump from 20 is a major-version move, so allow time for breaking changes.

One caution on timing: the advisory reports no exploitation of any of the 16 flaws, and none of them is on CISA's Known Exploited Vulnerabilities list — but the details are public now, so the window between publication and patching is the risky one. Update from the advisory page, not from speculation.

FAQs

When did the Node.js November 11 security release ship?

It shipped on Wednesday, 11 November 2026 — on schedule. The fixed builds are 22.23.5, 24.22.3 and 26.13.1, and the advisory was updated with the full list of 16 CVEs the same afternoon.

Which Node.js versions fix CVE-2026-123864?

Node.js 22.23.5, 24.22.3 and 26.13.1 — one fixed build per supported line. All three shipped on 11 November 2026. Anything below those versions on the 22.x, 24.x or 26.x lines is unpatched.

Is the November 2026 Node.js release being exploited?

No. The advisory reports no attacks using any of the 16 flaws, and none of them is on CISA's Known Exploited Vulnerabilities list. But the flaw details are public now, so patching promptly is what matters.

Is Node.js 20 still supported?

No. Node.js 20 reached end of life on 30 April 2026 and receives no security releases. The project warns that end-of-life versions are always affected when a security release occurs, so Node.js 20 and Node.js 25 (end of life 1 June 2026) are exposed to the November flaws with no fix. Move to Node.js 24 or 26.

How do I update Node.js to the patched version?

First check your version with node -v. Then update through your usual route — your OS package manager, nvm install 24.22.3 (or 22.23.5, or 26.13.1), volta, the installer from nodejs.org, or a new Docker base image — and restart the running process, then rebuild and redeploy any binaries compiled with the old toolchain. Test in staging first. If you install from your Linux distribution's packages, check its changelog for these CVE IDs, since distributions often backport fixes rather than bumping the version number.

Takeaway

The November 11 Node.js security release has shipped: 22.23.5, 24.22.3 and 26.13.1 fix 16 flaws, seven rated HIGH — including an HTTPS bug that can leak TLS private keys and HTTP/2 bugs an unauthenticated client can trigger. There is no workaround and no exploitation reported, but the details are public now, so the patch window is the risky one.

Run node -v on every machine you control, update to your line's fixed build, restart the process and rebuild your container images. If you are on Node.js 20 or 25, this release is also your deadline to start moving — no fix is coming for those lines.

Sources

Comments

Post a Comment