Node.js Nov 2026 security fixes: am I affected?

Am I affected: Node's November 11, 2026 post says these issues affect the active 22.x, 24.x, and 26.x lines, not every CVE on every line, and that end-of-life versions are affected too. The patched downloads are 22.23.5, 24.22.3, and 26.13.1.

Do now: Upgrade to 22.23.5, 24.22.3, or 26.13.1 for your line, or a later release on that line, and redeploy anything that pins Node.

The Node.js security post for Wednesday, November 11, 2026 says updates are available for the 26.x, 24.x, and 22.x lines. The downloads it names are Node.js 22.23.5, Node.js 24.22.3, and Node.js 26.13.1. Each of those release notes is dated 2026-11-11 and says it is a security release. The same security post still includes the earlier notice that releases would be available on or shortly after Wednesday, November 11, 2026. Above that text, the page says the security releases are available and links those three versions.

Node rates the highest issue in the release, and the highest issue on each of the 22.x, 24.x, and 26.x lines, as high. The post lists 16 CVEs: 7 high, 6 medium, and 3 low. It does not publish numeric severity scores. It says end-of-life versions are always affected when a security release occurs, and to use an up-to-date version from the Node.js release schedule. It does not give an upper bound such as "before 22.23.5". The affected line for each CVE below is the line list on that post. The only place "or later" belongs is the upgrade to the patched download for your line.

The previous Node.js security release, on October 21, 2026, is Node.js fixed a Brotli decoder bug that can run code, and Vercel says Node 20 projects must move to 22 or 24. That page covers CVE-2026-111497. This November post does not mention it.

High

Node's label is in parentheses. The line list is the post's "active release lines" for that CVE.

• CVE-2026-123863 (high). Lines: 24.x, 26.x. An unauthenticated HTTP/2 client can abort the server, over TLS or cleartext, when a handler responds before the request body has ended. The post calls it a variant of CVE-2024-27983 that the earlier fix did not cover.
• CVE-2026-123864 (high). Lines: 22.x, 24.x, 26.x. An unauthenticated client can cause an HTTPS server to copy its own heap, including other connections' data and TLS private keys, into the request body. The post says this needs a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk. Reading the leaked memory also requires a route that echoes or stores a request body. Cleartext node:http is not affected.
• CVE-2026-123865 (high). Lines: 22.x, 24.x, 26.x. An unauthenticated HTTP/2 client can leave server memory and file descriptors allocated if a protocol error happens while the session is already shutting down. The post says the attacker can start that shutdown with GOAWAY(NO_ERROR), and that this is an incomplete fix of CVE-2026-48937.
• CVE-2026-123866 (high). Lines: 22.x, 24.x, 26.x. HTTP/2 stream teardown while a write is still backpressured can send freed response memory to the peer. On 26.x and 24.x, a remote peer can drive that teardown once the window-size change from 26.9.0 and 24.22.0 is present. On all supported lines, the post says the same defect is also reachable through an application-initiated teardown, such as a per-stream idle timeout.
• CVE-2026-126051 (high). Lines: 24.x, 26.x. A remote unauthenticated attacker can terminate a TLS server process when the server uses SNICallback, OCSPRequest, newSession, or resumeSession, or calls server.addContext().
• CVE-2026-123872 (high). Lines: 22.x, 24.x, 26.x. On a server that applies different client-certificate policies per hostname, TLS 1.2 renegotiation lets a client change servername and carry its existing authentication to a host it was not authorized for.
• CVE-2026-123874 (high). Lines: 24.x, 26.x. An unauthenticated client can corrupt server memory, over TLS or cleartext, when the application serves a file with respondWithFile() or respondWithFD().

Medium

• CVE-2026-123828 (medium). Lines: 24.x, 26.x. A one-byte heap overflow when the application passes an attacker-controlled value to Http2Session.altsvc(). The post describes a request with a long but syntactically valid :authority header triggering the write when the application passes that header to the method.
• CVE-2026-123867 (medium). Lines: 22.x, 24.x, 26.x. A per-host client CA set with server.addContext(host, { ca }) and no server certificate in that SNI context is never installed, so the handshake falls open to the default client CA. A client trusted only by the default CA can then complete mutual TLS to the protected hostname.
• CVE-2026-123868 (medium). Lines: 24.x, 26.x. Inbound HTTP/2 data queued on an undrained stream is not charged to the session memory budget, so maxSessionMemory neither bounds that growth nor refuses new streams.
• CVE-2026-123871 (medium). Lines: 22.x, 24.x, 26.x. Proxy credentials are copied into ERR_PROXY_INVALID_CONFIG error messages. The post says the proxy URL comes from the environment, and that the defect is the sink: a credential Node redacts elsewhere is written into places such as stderr, container logs, log aggregation, and crash reporting.
• CVE-2026-123877 (medium). Lines: 22.x, 24.x, 26.x. https.Agent can reuse a TLS session between a request that omits ca and a later request that sets ca to an empty array. Omitting ca uses the default trust store. Supplying ca replaces it. The post says those two policies share a cache key, so TLS 1.3 session resumption can carry authentication under the default store into a connection whose stricter policy would reject the server on a fresh connection.
• CVE-2026-123875 (medium). Lines: 22.x, 24.x, 26.x. Cancelling a download served with respondWithFile() or respondWithFD() crashes the server with a NULL dereference, over TLS or cleartext.

Low

• CVE-2026-123829 (low). Lines: 22.x, 24.x, 26.x. On macOS or Windows, recursive fs.watch() under --permission can report names of descendants the process is not permitted to read. The post says this exposes names and timing, not file contents, and that it needs files created under the watched directory by another actor.
• CVE-2026-123862 (low). Lines: 22.x, 24.x, 26.x. Calling zlib deflate.params() while streaming to a peer can throw an uncatchable ERR_INTERNAL_ASSERTION if the stream is destroyed first. The post says an application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon.
• CVE-2026-106071 (low). Lines: 22.x, 24.x, 26.x. A wildcard --allow-fs-read or --allow-fs-write grant can match a shorter path when the grant sits directly under the root of the permission tree, such as when it is the only grant for that scope. The post's example is --allow-fs-read=/etc/passwd.* also allowing a read of /etc/passwd.

What the release notes add

The security post's line lists and the release notes are not the same list.

The 22.23.5 notes also list fixes for CVE-2026-123863, CVE-2026-123874, CVE-2026-123828, and CVE-2026-123868. The security post assigns those four to 24.x and 26.x and does not list 22.x for them. The 22.23.5 notes do not list CVE-2026-126051, which matches the post's 24.x and 26.x line for that CVE.

All three release notes list CVE-2026-123873 as low, with the subject "permission: check heap snapshot destination." The security post does not list CVE-2026-123873. This item does not describe a mechanism the post does not state.

The security post says CVE-2026-106071 affects 22.x, 24.x, and 26.x. That CVE id is not in the notable changes of the 22.23.5, 24.22.3, or 26.13.1 notes. The 22.23.5 and 24.22.3 notes include a commit titled "src: fix the fs permission tree node on wildcard nodes" without that CVE id. The 26.13.1 notes do not show that commit title.

Dependency updates

The security post says this release includes dependency updates for public vulnerabilities, and it names the lines without package versions: llhttp on 22.x, 24.x, and 26.x; undici on 24.x and 26.x; sqlite on 22.x and 24.x.

The release notes give versions. All three update llhttp to 9.4.4. The 24.22.3 notes update undici to 7.30.2, and the 26.13.1 notes update undici to 8.12.4. The 22.23.5 notes do not list an undici update, which matches the post's 24.x and 26.x line for undici. All three notes update sqlite to 3.54.1, including 26.13.1, while the security post lists sqlite for 22.x and 24.x only. The 24.22.3 and 26.13.1 notes also update brotli to 1.2.1. The November 11 security post does not mention Brotli, and the 22.23.5 notes do not list a brotli update. CVE-2026-111497 is the October 21 issue linked above.

What to do

Upgrade to the patched download for your line, 22.23.5, 24.22.3, or 26.13.1, or a later release on that line, and redeploy. Our advice, not Node's: a serverless app or a container that pins a Node version keeps the old runtime until you bump the pin and redeploy. Check whether your host has published its own bulletin. We did not find a Vercel bulletin for this November release when we checked Vercel's security bulletin index on November 11, 2026. That check is ours. If you are on an end-of-life line, the November post says those versions are affected and points you at an up-to-date release. Our advice: move that pin to 22.23.5, 24.22.3, or 26.13.1, or a later release on one of those lines, then redeploy.