Node.js rolled out coordinated security updates, patching 16 CVEs across its three supported LTS lines: v26.13.1 "Lithium", v24.22.3 "Krypton", and v22.23.5 "Jod", with seven rated HIGH. Most flaws live in the HTTP/2 and TLS layer your servers expose to the internet, and several are remotely exploitable with no authentication at all. But the catch: end-of-life lines like Node 20 "Iron" got nothing, and third-party trackers note a small discrepancy in the CVE count. Upgrade to a patched release if you're still running older code.

Node.js ships 16-CVE security patch across three LTS lines, leaving end-of-life versions behind

The November 11 release patches HTTP/2 and TLS flaws across three LTS lines. If you're still on Node 20, you're on your own.

On Wednesday, November 11, 2026, the Node.js Project rolled out coordinated security updates to all three of its supported release lines at once. The fixes land in v26.13.1 "Lithium", v24.22.3 "Krypton", and v22.23.5 "Jod". Together they patch 16 CVEs, which breaks down as seven HIGH, six MEDIUM, and three LOW.

Nearly every vulnerability lives in the networking and security layer. I'm talking HTTP/2 and TLS, the code path that faces the public internet in just about every Node.js API server. Several of those HIGH flaws are remotely exploitable without authentication at all.

Keep in mind that this is the second HIGH-severity security release in three weeks. The 21 October patch closed a Brotli remote-code-execution bug (CVE-2026-111497). Upgrading now covers both rounds.

Not every version is affected equally

The official advisory assigns per-CVE line scope, which means not every flaw touches every release. Node 26.x and 24.x take all 16. Node 22.x takes only 11, missing five that exist purely in newer code introduced by window-size changes in 26.9.0 and 24.22.0.

That mismatch leaks into the dependency table as well. The v22 line skips the undici and sqlite bumps and doesn't carry the brotli fix, since those issues simply don't apply to it. Node 24 and 26 both updated undici, though to different majors: 8.x on Lithium, 7.x on Krypton.

The standout flaw is CVE-2026-123864. It's a re-entrancy bug in node:https where a handler calls res.flushHeaders() before the request body ends, then later calls res.end() with a non-empty chunk. The parser re-enters mid-body, causing a use-after-free heap read. The server then copies that freed or unrelated heap memory into the response, potentially exposing TLS private keys and other connections' request bodies.

Here's the catch: cleartext HTTP is not affected. Only HTTPS servers with that specific handler pattern are on the hook. Reporter Chris Rohlf, working with Claude and Anthropic Research, flagged it. Matteo Collina (mcollina) wrote the fix.

A lot for some teams, a trap for others

On top of the headline CVEs, this batch pulls in a pile of dependency updates. llhttp jumped to 9.4.4 across all three lines. sqlite moved to 3.54.1 on 26.x and 24.x. Two TLS bugs are worth knowing about: a heap overflow in Alt-Svc handling (CVE-2026-123828) and a per-host mTLS fail-open bug (CVE-2026-123867).

The mTLS one is quietly bad. When a server assigns a hostname a different client-cert CA via server.addContext() but leaves out a server certificate in that SNI context, the per-host CA never gets installed. The handshake falls back to the default CA. Anyone who built per-host authorization on top of client certs should look here first.

Then there's the part that's less pleasant. The advisory does not patch end-of-life versions. It simply repeats the standing policy that "End-of-Life versions are always affected when a security release occurs."

So Node 26, 24, and 22 are covered. Node 25 is not, having last shipped 25.9.0. Node 20 "Iron" is not, even though it still "works" for plenty of organizations that have stopped paying attention. It has now missed several security releases in a row.

The only path to a patch for an EOL line is paid commercial support through an OpenJS Ecosystem Sustainability Program partner. For a small shop with no budget for End-of-Life Support, that's a design choice that leaves them exposed. No patch path exists for those lines. Just a bill.

You might wonder why anyone lingers on Node 20. It's often cheaper to keep running it than to rip out and rebuild. The flaw just sits there until the upgrade finally happens.

Two HIGH batches in three weeks tells you the networking stack is under scrutiny. The nghttp2-backed HTTP/2 implementation and the TLS handling have been a steady source of memory-safety bugs in C++ code. That tracks with what we've seen across the industry, where complex networking code is a reliable source of grief. This batch is dense and mostly about memory management in code you'd rather not think about. But that's exactly the plumbing you want to stay quiet.

There's also the structural shift happening in the background. Node 26 is the last major under the old two-releases-a-year model. Starting with Node 27 in October 2026, the project moves to one major per year, promoted to LTS each October, with every major becoming LTS and a brand-new Alpha channel.

For what it's worth, the feature context is worth a mention. Node 24 "Krypton" added stable built-in WebSocket support and OpenSSL 3.5. Node 26 "Lithium" enabled the Temporal API by default, the long-awaited fix for JavaScript date and time handling.

One detail that only people following the release notes closely would catch: the official advisory counts 16 CVEs, but the per-version changelogs list a 17th entry, CVE-2026-123873, which the consolidated advisory omits while it does enumerate CVE-2026-106071. Third-party trackers have flagged the discrepancy. "16" is the number to cite. Just be aware the ledger isn't perfectly clean.

The practical advice from the advisory and third-party runbooks is straightforward. First, inventory every Node runtime you can find: servers, containers, CI runners, serverless runtimes, and npm-installed CLIs like bundlers and test runners. Run node -v and node -p "process.versions". Inspect Dockerfiles, .nvmrc, and the engines.node field.

Then upgrade to 26.13.1, 24.22.3, or 22.23.5, matching whichever line your app targets. Rebuild container images with docker build --pull --no-cache and pin by line, not by patch, so future fixes auto-apply. Restart every long-running process, since a server keeps the old binary in memory until it exits.

If you can't upgrade today, terminate TLS at a trusted proxy, disable HTTP/2 where you don't need it, and disable TLS 1.2 renegotiation on mTLS servers. None of these replace the patch.

Node.js — Node.js 26.13.1 (LTS)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 26.13.1 (LTS)

Node.js — Node.js 24.22.3 (LTS)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 24.22.3 (LTS)

Node.js — Node.js 22.23.5 (LTS)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 22.23.5 (LTS)