Node.js November 2026 security release: 7 High HTTP/2, TLS fixes

Three weeks after the Brotli fix, Node.js is back with a bigger batch. The Node.js November 2026 security release shipped on November 11 and fixes 16 CVEs across every supported line. Seven are rated High, and almost all of them sit in the code that serves your traffic: HTTP/2, HTTPS and TLS. If your store, API or webhook handler runs on Node, this one goes on the calendar this week, not next month.

What actually happened

The Node.js advisory lists the fixed versions as 22.23.5, 24.22.3 and 26.13.1, each with its own release notes. The High-severity fixes include:

• CVE-2026-123864: a zero-length TLS write on an HTTPS server can re-enter the HTTP parser, causing a use-after-free that can leak heap memory into a request body. Plain node:http is not affected.
• CVE-2026-123863, -123865, -123866 and -123874: four HTTP/2 bugs. One lets an unauthenticated client abort the process. Others leak memory and file descriptors, send freed memory to the peer, or use a freed stream during respondWithFile().
• CVE-2026-123872: TLS 1.2 renegotiation or resumption can change the SNI hostname, which can bypass per-hostname client-certificate rules.
• CVE-2026-126051: deferred TLS handshake callbacks can touch a destroyed socket and crash a TLS server.

The medium and low fixes cover mTLS policy bypasses, proxy credentials leaking into an error message, an https.Agent session cache mix-up, and Permission Model bypasses. The release also updates bundled llhttp, Undici, SQLite and Brotli. As always, end-of-life lines are affected and get no patch.

One detail worth noticing: the advisory credits five of the CVEs to a researcher working "with Claude and Anthropic Research," and one to Trail of Bits (OpenAI). AI-assisted bug hunting is now a steady source of Node.js fixes.

Why the Node.js security release matters for your business

A crash is an outage. Several of these bugs let a remote client kill or wedge a Node process. For a checkout or booking flow, that's lost revenue, not a log line.

HTTP/2 and TLS live at the edge. If Node terminates TLS or speaks HTTP/2 directly, you're in the blast radius. If a proxy or CDN handles that in front of Node, your exposure is lower, but don't assume. Check the config.

Find every Node runtime. The main app is the easy part. Docker images pinned to an old tag, serverless runtimes, CI runners and that one cron box on a VPS are where old versions hide. Run node -v everywhere.

Sources: Node.js November 2026 security releases, Node.js v26.13.1 release notes.