Node.js fixes HTTP/2 and HTTPS flaws that can crash or leak data
Nov 12, 2026 · Summarized by Fundy Tech from The Hacker News
Node.js fixed 16 flaws, including HTTP/2 and HTTPS bugs that can crash servers or leak memory from other connections. The project released fixes for all supported lines.
Key points
- Fixed versions are 22.23.5, 24.22.3, and 26.13.1.
- CVE-2026-123863 can crash HTTP/2 servers.
- CVE-2026-123864 may expose TLS private keys and requests.
Why it matters
If your app runs its own Node.js server, these bugs can affect uptime and data privacy. The HTTPS issue is especially important because it can leak sensitive memory, including TLS private keys. Small businesses that host web apps should update quickly and review any systems using affected Node.js lines. End-of-life versions do not get this fix.
Who’s affected: Node.js servers using built-in HTTP/2 or HTTPS
What to do
- Update to the fixed Node.js release for your line.
- Review any servers using built-in HTTP/2 or HTTPS.
- Move off end-of-life Node.js versions.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.