Blog / 02

Node.js 26.5.1, 24.18.1, 22.23.2 Patch 11 CVEs

WebRestart

On July 29, 2026 the Node.js project published security releases for every supported line at once: v26.5.1 (Current), v24.18.1 (LTS) and v22.23.2 (LTS). Between them they fix 11 CVEs — three High, five Medium and three Low. If you run anything on Node in production, this is a patch-this-week release, not a read-later one.

That includes almost everything we build: a Next.js app, a NestJS API, and any Node process fronting an Asterisk stack all inherit these bugs from the runtime, regardless of framework version.

The three High-severity flaws

HTTP/2 memory exhaustion (CVE-2026-56846)

Retained header blocks can evade the maxSessionMemory limit, letting a remote client drive memory exhaustion on a server that thought it had a cap in place. Affects 24.x and 22.x. Reported by leduckhuong, fixed by mcollina.

HTTP/2 heap use-after-free (CVE-2026-56848)

nghttp2_session_mem_send() can be called re-entrantly while nghttp2_session_mem_recv() is still executing, producing a heap use-after-free. This one hits all three lines — 26.x, 24.x and 22.x. Reported by hahahkim, fixed by mcollina.

Both HTTP/2 issues only matter if your Node process actually terminates HTTP/2. If a reverse proxy speaks HTTP/2 to the browser and plain HTTP/1.1 to Node — the common shape behind nginx, Caddy or a managed platform — your exposure is smaller. That is a reason to sleep at night, not a reason to skip the upgrade.

Permission Model over-grants filesystem access (CVE-2026-58043)

Under --permission, path matching can over-grant across radix-tree prefix boundaries: an attacker granted access to one path can read or write outside the intended allowlist. Affects all three lines. Reported by sy2n0, fixed by RafaelGSS.

The Permission Model is opt-in, so this only bites processes started with --permission. If you have adopted it as a containment layer around untrusted code, note that two of the Low-severity fixes are in the same area: trace events (CVE-2026-56847) and process reports (CVE-2026-58039) could both write outside the allowlist. Three separate escape routes in one release is a fair signal that the Permission Model is still maturing and should not be your only boundary.

The Medium and Low fixes

  • CVE-2026-56850 — HTTPS Agent can reuse mTLS identities across PFX certificates (Medium)
  • CVE-2026-58040 — HTTPS Agent session reuse can skip hostname verification (Medium)
  • CVE-2026-58041 — node:sqlite SQLTagStore iterator replay can re-execute writes (Medium, 26.x and 24.x only)
  • CVE-2026-58042 — dns.resolveAny() can abort on DNS responses with many A records (Medium)
  • CVE-2026-58045 — node:zlib sync APIs can crash on a spoofed TypedArray length (Medium)
  • CVE-2026-58044 — HTTP parser header truncation can enable request smuggling (Low)

CVE-2026-58040 deserves a second look: it is logged as an incomplete fix for CVE-2026-48934. If you patched for that earlier advisory and closed the ticket, the hole is still partly open until you land 26.5.1 / 24.18.1 / 22.23.2. Incomplete-fix follow-ups are exactly the kind of thing that slips through a "we already patched that" triage.

The release also bumps two bundled dependencies to pick up their own published fixes: undici to 8.9.0 / 7.29.0 / 6.28.0 depending on line, and llhttp to 9.4.3 across all three. The llhttp bump is what carries the request-smuggling fix.

What to do

Check what you are actually running, which is rarely what your .nvmrc claims:

node --version
docker run --rm node:24-alpine node --version

Then upgrade the runtime everywhere it exists — and it exists in more places than most teams remember:

  • Application servers and container base images (FROM node:24 pulls the new patch once you rebuild; a pinned digest does not)
  • CI runners and build images
  • Serverless and edge platform runtime settings, which are often a dropdown you set once in 2024
  • Local dev machines, via nvm install --lts or your version manager of choice

Because these are patch releases within each line, upgrading is a rebuild rather than a migration. There is no API surface change to work around.

The pattern here is worth internalising: framework patching and runtime patching are separate jobs. Updating Next.js does nothing for a Node HTTP/2 use-after-free, and updating Node did nothing for the 13 Next.js advisories we covered in May. Both queues need an owner.

Full details, including credits and the complete impact matrix, are in the official Node.js advisory. Line support status is on the previous releases page.

Not sure which Node versions are running across your estate, or who owns the upgrade? Talk to us — we do runtime audits and upgrade paths that do not turn into three-month projects.

All posts