Node.js Patches 11 Vulnerabilities, Some Critical, Allowing Server Crashes

Key Takeaways

• Node.js has released critical security updates addressing 11 vulnerabilities across active branches 22.x, 24.x, and 26.x.
• Two high-severity HTTP/2 vulnerabilities (CVE-2026-56846, CVE-2026-56848) could lead to denial-of-service or process crashes.
• A critical flaw (CVE-2026-58043) in the Node.js Permission Model could allow unauthorized filesystem access.
• Patches are available in Node.js versions v22.23.2, v24.18.1, and v26.5.1.
• Immediate upgrades are strongly recommended for all Node.js administrators.

The Node.js project has issued a series of crucial security updates, addressing a total of 11 vulnerabilities impacting its actively maintained branches: 22.x, 24.x, and 26.x. These patches are designed to mitigate risks ranging from denial-of-service attacks to unauthorized file system access and other critical system stability issues.

The latest versions, v22.23.2, v24.18.1, and v26.5.1, are now available, incorporating fixes for various components including HTTP/2 processing, the Permission Model, HTTPS connection management, DNS resolution, SQLite handling, Zlib APIs, and the HTTP parser. Alongside these core fixes, Node.js has also updated its integrated Undici dependency to versions 8.9.0, 7.29.0, and 6.28.0, depending on the specific release line, and the llhttp dependency to version 9.4.3.

Critical HTTP/2 Vulnerabilities Uncovered

Among the most severe issues are two high-severity HTTP/2 vulnerabilities that pose a significant threat of remote attackers disrupting Node.js services. The first, identified as CVE-2026-56846, allows for a bypass of the maxSessionMemory limit for retained HTTP/2 header blocks. This flaw could enable an attacker to craft malicious traffic that consumes excessive server memory, ultimately leading to a denial-of-service condition.

The second critical HTTP/2 vulnerability, CVE-2026-56848, affects all active Node.js release lines. This flaw can trigger a heap use-after-free condition when the underlying nghttp2 library processes data concurrently with receiving additional input. Such memory safety issues can result in process crashes and may carry broader security implications depending on the specific runtime environment.

Permission Model Flaw Exposes Filesystems

The security release also addresses CVE-2026-58043, a high-severity vulnerability within the Node.js Permission Model. This defect could cause applications launched with the --permission option to inadvertently grant filesystem access beyond their configured allowlist. The issue stems from problems in how radix-tree prefix boundaries are handled, potentially allowing an attacker with access to an approved path to read or write files in unauthorized locations.

Medium-Severity Issues and Stability Fixes

Several medium-severity bugs impacting HTTPS and overall application reliability have also been patched. CVE-2026-56850 could lead to HTTPS Agents improperly reusing mutual TLS identities across requests utilizing different PFX certificates. Additionally, CVE-2026-58040 corrects an incomplete prior patch that could allow TLS session reuse to bypass hostname verification across distinct identity policies.

Other fixes target potential crashes related to oversized DNS responses and manipulated TypedArray lengths. Specifically, CVE-2026-58042 could cause dns.resolveAny() to abort if a response contains more than 256 A records. Furthermore, CVE-2026-58045 addresses a flaw that could crash synchronous Node:zlib APIs when processing a spoofed TypedArray byte length.

Additional Patched Vulnerabilities

Node.js has also resolved lower-severity Permission Model bypasses, CVE-2026-56847 and CVE-2026-58039, related to trace-event logs and process reports respectively. Both vulnerabilities could allow writing files outside of paths explicitly authorized by --allow-fs-write. For a complete overview of all resolved issues, refer to the official Node.js security release notes.

Finally, CVE-2026-58044 addresses an issue involving HTTP header truncation that could facilitate request smuggling attacks in Node.js-based forwarding proxies. This ensures that HTTP headers are processed correctly, preventing potential manipulation.

What You Should Do

• Upgrade Immediately: All administrators and developers running Node.js applications are strongly advised to upgrade to the latest patched versions: v22.23.2, v24.18.1, or v26.5.1, depending on your active branch.
• Test Dependencies: Before deploying to production, thoroughly test all application dependencies with the new Node.js versions to ensure compatibility and stability.
• Retire Unsupported Versions: Immediately discontinue the use of any unsupported Node.js versions, as these will not receive security updates and remain vulnerable to newly disclosed flaws.
• Review Permission Model Usage: If your applications utilize the Node.js Permission Model (--permission flag), review your allowlist configurations to ensure they are robust and correctly defined.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.