Node.js November 2026 Security Release: What to Upgrade and Why

On November 11, 2026, the Node.js project released security fixes for all three supported lines: 22.x, 24.x and 26.x. The release fixes 16 vulnerabilities, seven rated high, and most of the high ones are in the HTTPS, HTTP/2 and TLS server code that almost every Node.js web service runs. Upgrade to 22.23.5, 24.22.3 or 26.13.1.

This release comes three weeks after the October 21 release that fixed the Brotli decoder bug. If you upgraded then, you need to upgrade again: the October versions don't include these fixes.

What the high-severity bugs do

All seven can be triggered by a remote client without credentials, and they fall into three groups.

Two let a client read memory the server didn't mean to send. In HTTPS, a zero-length write during request parsing makes the server copy its own heap into the request body, which the advisory says can expose TLS private keys and other users' requests (CVE-2026-123864). In HTTP/2, tearing down a stream while a write is backpressured can send freed response memory, including other connections' response buffers, to the peer (CVE-2026-123866).

Four let a client crash the server or wear it down. One reachable assertion in HTTP/2 session teardown aborts the process (CVE-2026-123863). A protocol error during HTTP/2 connection shutdown leaks memory and file descriptors for good (CVE-2026-123865). Resetting a stream served with respondWithFile() during a pending write corrupts memory (CVE-2026-123874). And a TLS server that uses SNICallback, OCSPRequest, newSession, resumeSession or server.addContext() can be terminated during the handshake (CVE-2026-126051).

The seventh bypasses client-certificate authentication. On a server with different client-certificate rules per hostname, a client can change the server name during TLS 1.2 renegotiation to reach a host it isn't authorized for (CVE-2026-123872).

The release also fixes six medium and three low issues, and updates llhttp on all three lines, Undici on 24.x and 26.x, and SQLite on 22.x and 24.x.

Which versions fix it

• Node.js 26 (Current): 26.13.1
• Node.js 24 (LTS): 24.22.3
• Node.js 22 (LTS): 22.23.5

Five of the 16 issues, three of them high, affect only 24.x and 26.x, so 22.x has four high-severity fixes rather than seven. The advisory lists no workaround. End-of-life lines get no fix at all: in the advisory's words, "End-of-Life versions are always affected when a security release occurs." If you're on Node.js 20 or older, move to 22 or 24.

How to check your app

Find the version you actually run, not the one on your laptop: print process.version at startup or run node -v in your container image. Anything below the versions above is affected.

Then upgrade and redeploy, even if you don't use HTTP/2 or client certificates. The HTTPS memory read affects ordinary HTTPS servers, and the other fixes ship in the same release.

Updating on ComputeSphere

If you deploy from source without a Dockerfile, builds now use Node.js 22.23.5 for Node.js 22 and 24.22.3 for Node.js 24. A running service keeps the image it was built with, so rebuild it to pick up the fix; we don't start that rebuild for you. One exception: if your service's runtime version is set to an exact patch, such as 22.23.4, a rebuild keeps that version. Set it to 22 or 24 instead, and the build log tells you when this applies. A service on Node.js 18 or 20 can't be fixed by a rebuild either: set its runtime version to 22 or 24, then rebuild.

If you deploy from your own Dockerfile with a floating tag, such as FROM node:22-slim, a rebuild pulls the patched release. If your Dockerfile pins an exact version, update the FROM line, for example to node:24.22.3-slim, and push.

Your service's Security tab shows where each image stands. After the next daily scan, an image on an affected version lists the node package with the version it runs, each CVE at the severity the Node.js release gives it, the fixed version to move to, and each CVE linked to the advisory. It also says which fix applies to how that service builds: a rebuild for platform builds, or a newer base image for Dockerfiles.

Either way, check the build log for the Node.js version that was installed, and confirm process.version in your logs after the deploy.

Sources

• Node.js: Wednesday, November 11, 2026 Security Releases
• Node.js release notes: v22.23.5, v24.22.3, v26.13.1
• Our earlier post: Node.js October 2026 Security Release: Check and Patch the Brotli RCE

Last checked November 14, 2026.