Node.js November 2026 Security Releases: Deconstructing HTTP/2 Remote Aborts, HTTPS Heap Leaks, and TLS Race Conditions

Executive Summary

On Wednesday, November 11, 2026, the Node.js project published its scheduled monthly security release across all active Long Term Support (LTS) release lines: Node.js 26.13.1 (LTS), Node.js 24.22.3 (LTS), and Node.js 22.23.5 (LTS). The coordinated update remediates 16 security vulnerabilities, including seven rated High severity, spanning core networking subsystems: the HTTP/2 implementation (node:http2), the HTTPS/TLS session termination engine (node:tls), the underlying llhttp parser, and bundled runtime dependencies.

The most critical defect in the advisory is CVE-2026-123863, an unauthenticated remote Denial of Service (DoS) vulnerability in Node.js HTTP/2 server session teardown. By arranging for an Http2Stream holding nghttp2-allocated header buffers to outlive its parent session, a remote attacker can trigger an internal assertion failure—CHECK_EQ(current_nghttp2_memory_, 0)—inside ~Http2Session(). Because the assertion is evaluated in C++ native runtime code, the failure immediately terminates the Node.js process without emitting a catchable JavaScript error event.

Equally alarming for enterprise multi-tenant architectures is CVE-2026-123864, a high-severity re-entrancy flaw in Node.js HTTPS. When an application executes a zero-length TLS write inside an HTTP parser callback, the TLS wrapper prematurely invokes buffer clearing routines while the parser is mid-body. This re-enters llhttp_execute(), triggering a use-after-free (UAF) condition and an out-of-bounds heap read that copies unrelated process memory—including TLS private keys and request payloads belonging to other concurrent connections—directly into the HTTP response body.

Rounding out the high-severity networking defects is CVE-2026-126051, a deferred-callback use-after-destroy race condition in TLS server handshakes (SNICallback, OCSPRequest, server.addContext()) that allows unauthenticated clients to abort server processes by timing socket closures.

This technical deep dive provides an exhaustive architectural autopsy of the Node.js November 2026 security release. We dissect the native C++ socket teardown mechanics, trace parser re-entrancy bugs, evaluate real-world exploit preconditions, provide a comprehensive affected release matrix, and deliver an enterprise hardening playbook for production Kubernetes and container environments.

---

1. Vulnerability Architecture and Root Cause Analysis

1.1 CVE-2026-123863: HTTP/2 Remote Abort via Reachable Assertion in ~Http2Session()

The Node.js HTTP/2 module wraps the industry-standard nghttp2 C library, bridging native C++ memory management with the V8 JavaScript garbage collector. To prevent memory leaks, Node.js tracks all memory allocated by nghttp2 callbacks using an internal accounting variable: current_nghttp2_memory_.

When an HTTP/2 session terminates, the C++ destructor ~Http2Session() executes a fatal invariant assertion:

// src/node_http2.cc - Session Destructor Invariant
Http2Session::~Http2Session() {
    // Assert that all native nghttp2 memory buffers have been released
    CHECK_EQ(current_nghttp2_memory_, 0);
}

In standard operation, all active streams are detached from the session and their associated header and data buffers are freed before the session destructor executes. However, in CVE-2026-123863, an architectural race condition exists during asymmetric stream teardown:

1. Trigger Condition: A client initiates an HTTP/2 request with a body. A standard application handler sends a response (e.g., res.writeHead(200); res.end()) before the client finishes transmitting its request body.
2. Stream Removal without Detachment: Under specific window-size updates, the stream is removed from the session's active stream set, but native pointers to nghttp2-allocated header structures remain allocated.
3. Session Teardown Assertion: When the client closes the TCP socket or triggers a session termination, ~Http2Session() executes. Because the detached stream still holds uncollected header buffers, current_nghttp2_memory_ is non-zero (e.g., 256 bytes). The CHECK_EQ assertion fails, instantly terminating the process.

This vulnerability represents an incomplete remediation of CVE-2024-27983, as the earlier fix only detached streams that remained explicitly tracked within the session's active collection.

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-123863 HTTP/2 Teardown Assertion Failure                          |
+----------------------------------------------------------------------------------------------------+
|                                                                                                    |
|  [ Remote Client ]                                                  [ Node.js HTTP/2 Server ]      |
|         |                                                                      |                   |
|         | 1. HEADERS (Request stream initiated)                                |                   |
|         |--------------------------------------------------------------------->| (nghttp2 allocs)  |
|         |                                                                      |                   |
|         | 2. Server responds immediately (res.writeHead/end)                   |                   |
|         |<---------------------------------------------------------------------|                   |
|         |                                                                      |                   |
|         | 3. Client sends TCP FIN / GOAWAY before request body completes       |                   |
|         |--------------------------------------------------------------------->|                   |
|                                                                                |                   |
|                                                                 +-------------------------------+  |
|                                                                 | Native ~Http2Session() Runs   |  |
|                                                                 | - Stream unlinked from set    |  |
|                                                                 | - Header memory still tracked |  |
|                                                                 | - current_nghttp2_memory_ > 0 |  |
|                                                                 |                               |  |
|                                                                 | CHECK_EQ(mem, 0) FAILS!       |  |
|                                                                 | Process Aborts (SIGABRT)      |  |
|                                                                 +-------------------------------+  |
|                                                                                                    |
+----------------------------------------------------------------------------------------------------+

1.2 CVE-2026-123864: HTTPS Zero-Length Write Re-entrancy and Heap Information Leak

Classified with High severity, CVE-2026-123864 represents one of the most dangerous memory safety defects disclosed in Node.js in recent years. It allows an unauthenticated remote client to extract sensitive process memory belonging to other concurrent TLS connections.

The vulnerability resides at the intersection of Node.js's TLSWrap class and the llhttp HTTP parsing engine:

1. The Zero-Length Optimization: In src/crypto/crypto_tls.cc, TLSWrap::DoWrite() handles outbound encrypted data. When asked to write zero bytes, the code executes an optimization that immediately calls ClearOut() to flush pending decrypted application data.
2. Parser Re-Entrancy: If a web application handler calls res.flushHeaders() before reading the entire incoming request body, a zero-length write is dispatched while JavaScript is executing inside llhttp's on_body callback.
3. Use-After-Free and Heap Read: ClearOut() decrypts the next incoming TLS record on the socket while the HTTP parser is in an intermediate state. This causes llhttp_execute() to re-enter recursively, invalidating internal parser pointers. The engine subsequently references freed memory slabs, copying arbitrary heap bytes into the response payload of the echoing route.

In production environments where Node.js services handle authenticated user traffic, an attacker sending specially crafted HTTP pipelined requests can capture session cookies, authorization bearer tokens, and TLS private keys retained in adjacent V8 heap buffers.

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-123864 HTTPS Parser Re-Entrancy Flow                               |
+----------------------------------------------------------------------------------------------------+
|                                                                                                    |
|  [ Incoming TLS Record ] ---> [ llhttp_execute() Parsing Body ]                                     |
|                                       |                                                            |
|                                       v (Application calls res.flushHeaders())                     |
|                               [ TLSWrap::DoWrite(0 bytes) ]                                        |
|                                       |                                                            |
|                                       v (Calls ClearOut() prematurely)                             |
|                               [ Decrypts Next TLS Packet ]                                         |
|                                       |                                                            |
|                                       v (RE-ENTERS llhttp_execute() mid-parse!)                    |
|                               [ Stale Pointers Referenced in Parser Heap ]                         |
|                                       |                                                            |
|                                       v                                                            |
|  [ Leaked Heap Memory (Private Keys, Adjacent Requests) Copied into HTTP Response Body ]           |
|                                                                                                    |
+----------------------------------------------------------------------------------------------------+

1.3 CVE-2026-126051: Deferred Handshake Callbacks and Socket Destruction Race

Node.js supports asynchronous hooks during the TLS handshake to allow dynamic certificate resolution and session validation: SNICallback, OCSPRequest, newSession, resumeSession, and server.addContext().

Because these operations may require database or filesystem queries, Node.js defers execution of the corresponding OpenSSL handshake callbacks to the libuv event loop. However, the native C++ bindings failed to verify whether the underlying TCP socket remained valid when the deferred callback finally executed:

• An attacker transmits a ClientHello configured to invoke a deferred hook (e.g., requesting an OCSP status without providing an SNI hostname), immediately followed by TCP padding and a TCP FIN packet.
• OpenSSL receives both the handshake initiation and the socket termination within the same event loop tick.
• The underlying socket is destroyed. When the deferred JavaScript callback resolves and attempts to resume the OpenSSL handshake on the destroyed native handle, Node.js raises an uncaught exception rather than emitting an 'error' event on the server instance.
• Because uncaught exceptions crash the Node.js event loop by default, an unauthenticated attacker can remotely crash the server with a single TCP handshake packet.

---

2. Additional High-Severity Flaws in the November Release

Beyond the primary DoS and memory leak vectors, the November 11 release resolves four additional high-risk vulnerabilities across the protocol stack:

+----------------------------------------------------------------------------------------------------+
|                         Summary of High-Severity Flaws in November 11 Release                       |
+----------------------------------------------------------------------------------------------------+
| CVE Identifier  | Component       | Vulnerability Mechanism               | Potential Impact       |
+-----------------+-----------------+---------------------------------------+------------------------+
| CVE-2026-123863 | node:http2      | Assertion failure in ~Http2Session()  | Remote Server Abort    |
| CVE-2026-123864 | node:https      | Zero-length write llhttp re-entrancy  | Heap Memory Leak       |
| CVE-2026-126051 | node:tls        | Deferred callback use-after-destroy   | Uncaught Exception DoS |
| CVE-2026-123865 | node:http2      | Dangling session on protocol error    | Resource Exhaustion    |
| CVE-2026-123866 | node:http2      | UAF in stream teardown write buffer   | Response Memory Leak   |
| CVE-2026-123872 | node:tls        | TLS 1.2 renegotiation SNI mutation    | mTLS Auth Bypass       |
| CVE-2026-123874 | node:http2      | UAF in respondWithFile() reset        | Heap Corruption / DoS  |
+-----------------+-----------------+---------------------------------------+------------------------+

2.1 CVE-2026-123865: Permanent Memory and File Descriptor Exhaustion

In HTTP/2 implementations, protocol violations must result in an immediate session termination. In Node.js, if a remote peer transmits an invalid frame header while the session is already undergoing graceful connection shutdown (initiated by sending GOAWAY(NO_ERROR)), nghttp2 terminates the session internally, but Node.js fails to register the termination event. The underlying operating system TCP socket is left stranded in the CLOSE_WAIT state indefinitely. Attackers can flood a server with shutdown protocol errors, exhausting all available file descriptors and RAM without incurring bandwidth costs.

2.2 CVE-2026-123872: Mutual TLS (mTLS) Authentication Bypass via TLS 1.2 Renegotiation

In enterprise zero-trust architectures, servers frequently enforce different client certificate requirements based on the requested hostname (e.g., public API routes require no client certificate, while administrative subdomains enforce strict mTLS).

In CVE-2026-123872, a client connects to a permitted public host under TLS 1.2, successfully establishing a session. The client then issues an in-band TLS 1.2 renegotiation request, unilaterally changing the Server Name Indication (SNI) to an administrative hostname. Node.js carried forward the authenticated state from the initial handshake to the renegotiated connection, completely bypassing host-specific mTLS certificate verification.

---

3. Affected Software Versions and Release Baseline

The vulnerabilities impact all active and maintenance LTS release branches. The Node.js project has issued official patched binaries, container images, and source tarballs:

+----------------------------------------------------------------------------------------------------+
|                                Affected Release Lines and Remediation Baseline                      |
+----------------------------------------------------------------------------------------------------+
| Release Line  | Release Status  | Vulnerable Versions             | Minimum Patched Version        |
+---------------+-----------------+---------------------------------+--------------------------------+
| Node.js 26.x  | Active LTS      | v26.0.0 through v26.13.0        | Node.js v26.13.1 (LTS)         |
| Node.js 24.x  | Active LTS      | v24.0.0 through v24.22.2        | Node.js v24.22.3 (LTS)         |
| Node.js 22.x  | Maintenance LTS | v22.0.0 through v22.23.4        | Node.js v22.23.5 (LTS)         |
+---------------+-----------------+---------------------------------+--------------------------------+

Note: Node.js 20.x and earlier reached End-of-Life (EOL) and will not receive security backports from the Node.js foundation. Organizations running legacy versions must migrate to v22.x or apply commercial extended lifecycle support (ELS).

---

4. Threat Landscape, Exploit Feasibility, and Attack Surfaces

4.1 Unauthenticated Remote Execution Feasibility

Unlike privilege escalation vulnerabilities that require local shell access or compromised credentials, five of the seven high-severity flaws in the November release are triggerable by unauthenticated remote network clients:

• Public HTTP/2 Endpoints: Any Node.js application directly listening on public ports (e.g., microservices running Fastify, Express with SPDY/HTTP2, or custom RPC gateways) can be taken offline with single-digit request bursts using CVE-2026-123863.
• Microservices Behind Reverse Proxies: Organizations frequently terminate TLS at an edge reverse proxy (such as Nginx, Cloudflare, or AWS ALB) and proxy requests to upstream Node.js containers over HTTP/1.1 or cleartext HTTP/2:
  • If the edge proxy communicates with Node.js over HTTP/1.1, the HTTP/2 vulnerabilities (CVE-2026-123863, CVE-2026-123865) are neutralized, but the HTTPS heap leak (CVE-2026-123864) remains active if TLS termination occurs on the Node.js container itself.
  • If the edge proxy uses HTTP/2 multiplexing upstream, all HTTP/2 teardown flaws remain fully exploitable through the proxy.

---

5. Enterprise Hardening and Patching Playbook

Remediation requires immediate dependency upgrades combined with defensive architectural controls at the proxy and application layers.

5.1 Phase 1: Rapid Container Base Image Upgrades

Update Dockerfiles and container manifests to reference the patched LTS point releases immediately:

# Multi-stage Dockerfile: Enforce Patched Node.js LTS Baseline
FROM node:26.13.1-alpine AS builder

WORKDIR /usr/src/app
COPY package*.json ./
RUN npm ci --ignore-scripts

COPY . .
RUN npm run build

# Production minimal runtime
FROM node:26.13.1-alpine AS runner
WORKDIR /usr/src/app

ENV NODE_ENV=production
COPY --from=builder /usr/src/app/dist ./dist
COPY --from=builder /usr/src/app/node_modules ./node_modules
COPY package*.json ./

USER node
EXPOSE 3000
CMD ["node", "dist/server.js"]

5.2 Phase 2: Edge Reverse Proxy Buffering and TLS Offloading

To protect legacy or pending-patch Node.js applications from HTTP/2 assertion crashes, configure edge reverse proxies (such as Nginx) to terminate HTTP/2 and translate requests to standard HTTP/1.1 before forwarding traffic upstream:

# Nginx Hardening Configuration: Upstream Protocol Downgrade
# Mitigates CVE-2026-123863 and CVE-2026-123865 by isolating Node.js from raw HTTP/2 teardown
upstream nodejs_backend {
    server 127.0.0.1:3000 max_fails=3 fail_timeout=10s;
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name api.enterprise.internal;

    ssl_certificate /etc/ssl/certs/bundle.crt;
    ssl_certificate_key /etc/ssl/private/server.key;

    # Enforce TLS 1.3 to mitigate TLS 1.2 renegotiation bypasses (CVE-2026-123872)
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;

    location / {
        # Forward requests to Node.js strictly over HTTP/1.1
        proxy_pass http://nodejs_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Buffer client request bodies to prevent asymmetric stream teardown
        proxy_request_buffering on;
        proxy_buffering on;
    }
}

5.3 Phase 3: Defensive Node.js Application Coding

In applications serving HTTP/2 or HTTPS directly, avoid writing headers before the request body is consumed, and wrap deferred TLS callbacks in explicit socket state checks:

// Defensive Node.js TLS Server Configuration (Mitigating CVE-2026-126051)
import tls from 'node:tls';
import fs from 'node:fs';

const options = {
    key: fs.readFileSync('server.key'),
    cert: fs.readFileSync('server.crt'),
    minVersion: 'TLSv1.3', // Disable TLS 1.2 renegotiation entirely
    
    // Defensive SNICallback: Guard against destroyed sockets
    SNICallback: (servername, cb) => {
        // Asynchronous certificate resolution
        resolveCertificatesAsync(servername)
            .then(secureContext => {
                // Return resolved context safely
                cb(null, secureContext);
            })
            .catch(err => {
                console.error(`SNI resolution failed for ${servername}:`, err.message);
                cb(err);
            });
    }
};

const server = tls.createServer(options, (socket) => {
    socket.on('error', (err) => {
        console.error('Handled TLS socket error:', err.message);
    });
});

server.listen(8443, () => {
    console.log('Hardened TLS server listening on port 8443');
});

---

6. Semantic FAQ: Node.js November 2026 Security Releases

What is the most severe vulnerability in the Node.js November 2026 release?

The most critical flaws are CVE-2026-123863 (unauthenticated remote process abort in HTTP/2 session teardown) and CVE-2026-123864 (HTTPS parser re-entrancy leading to heap memory leaks of private keys and other users' requests). Both are rated High severity and can be exploited remotely by unauthenticated network clients.

Are applications using standard node:http (cleartext HTTP/1.1) affected?

No. Cleartext node:http servers do not implement the TLSWrap class or the nghttp2 session state machine, and are therefore immune to CVE-2026-123863, CVE-2026-123864, and CVE-2026-126051. However, cleartext servers may still be vulnerable to general HTTP/2 or proxy header bugs if behind misconfigured upstream gateways.

Does terminating TLS at an edge reverse proxy mitigate these flaws?

Yes, terminating TLS and HTTP/2 at an edge proxy (such as Cloudflare, Nginx, or an AWS Application Load Balancer) and proxying traffic to Node.js over standard HTTP/1.1 completely neutralizes CVE-2026-123863, CVE-2026-123864, and CVE-2026-126051, as the vulnerable C++ native handlers are never engaged.

What are the patched version numbers for each Node.js branch?

The patched releases are Node.js v26.13.1 for the 26.x Active LTS line, Node.js v24.22.3 for the 24.x Active LTS line, and Node.js v22.23.5 for the 22.x Maintenance LTS line.

Why does CVE-2026-123863 cause an immediate process abort instead of an error event?

The flaw triggers a native C++ assertion CHECK_EQ(current_nghttp2_memory_, 0) inside the ~Http2Session() destructor. Because this is an invariant failure within compiled runtime C++ code, the operating system raises a SIGABRT signal and terminates the process immediately, bypassing V8 exception handling and process.on('uncaughtException').

Are older Node.js versions like 18.x or 20.x patched?

No. Node.js 18.x and 20.x have reached official End-of-Life (EOL) status and do not receive public security patches. Organizations running these versions must upgrade immediately to Node.js 22.x, 24.x, or 26.x, or contract third-party Extended Lifecycle Support (ELS).

---

Sources

• Node.js Official Vulnerability Blog (November 11, 2026): "Wednesday, November 11, 2026 Security Releases" — https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
• GitHub Advisory Database (November 11–12, 2026): "Node.js Security Advisories: GHSA-m526-rv55-w6mr & CVE-2026-123863" — https://github.com/advisories/GHSA-m526-rv55-w6mr
• Rapid7 Vulnerability Database (November 12, 2026): "CVE-2026-123864 and CVE-2026-126051 Technical Analysis" — https://www.rapid7.com/db/vulnerabilities/cve-2026-123864/
• HKCERT Security Bulletin (November 12, 2026): "Node.js Multiple Vulnerabilities (High Severity Advisory)" — https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20261112
• TuxCare Enterprise Security (November 10–11, 2026): "Node.js November 11 Security Release and EOL Version Fixes" — https://tuxcare.com/blog/node-js-november-security-updates/