Node.js — Wednesday, November 11, 2026 Security Releases

Node.js published security updates for its 26.x, 24.x and 22.x release lines covering several vulnerabilities, most rated high. CVE-2026-123863, an HTTP/2 flaw, lets any unauthenticated client abort the server through session teardown and affects 24.x and 26.x. CVE-2026-123864, a high-severity HTTPS re-entrancy bug, can let an unauthenticated client read memory from other connections, including TLS private keys, on 22.x, 24.x and 26.x. Chris Rohlf, working with Claude and Anthropic Research, reported both issues.