The Node.js project has released important security updates addressing 11 vulnerabilities across its active branches: 22.x, 24.x, and 26.x.
The updates are now available as Node.js versions v22.23.2, v24.18.1, and v26.5.1. The July 2026 security release includes fixes for vulnerabilities related to HTTP/2 processing, the Permission Model, HTTPS connection reuse, DNS resolution, SQLite handling, Zlib APIs, and the HTTP parser.
Additionally, Node.js has updated its bundled Undici dependency to versions 8.9.0, 7.29.0, and 6.28.0, depending on the release line, along with the llhttp dependency to version 9.4.3. Two high-severity HTTP/2 vulnerabilities could potentially allow remote attackers to disrupt Node.js services.
CVE-2026-56846 enables retained HTTP/2 header blocks to bypass the configured maxSessionMemory limit. An attacker could send specially crafted traffic that consumes server memory, leading to a denial-of-service condition.
CVE-2026-56848 is another high-severity HTTP/2 issue affecting all active release lines. This vulnerability can trigger a heap use-after-free condition when the underlying nghttp2 library processes data while simultaneously receiving additional data.
Such memory safety issues can crash a process and may have broader security implications depending on runtime conditions. The update also addresses CVE-2026-58043, a high-severity vulnerability in the Node.js Permission Model.
Node.js Fixes Security Flaws
Applications launched with the --permission option could mistakenly grant filesystem access outside the intended allowlist due to problems in radix-tree prefix boundary handling. This flaw allows a user with access to an approved path to potentially read or write files in unintended locations.
Several medium-severity bugs affect HTTPS and overall application reliability. CVE-2026-56850 could result in HTTPS Agents reusing mutual TLS identities across requests with different PFX certificates. CVE-2026-58040 corrects an incomplete earlier patch that could permit TLS session reuse to bypass hostname verification across identity policies.
Other fixes aim to prevent crashes caused by oversized DNS responses and manipulated TypedArray lengths. CVE-2026-58042 can cause dns.resolveAny() to abort when the response contains more than 256 A records, while CVE-2026-58045 can crash synchronous Node:zlib APIs when using a spoofed TypedArray byte length.
Patched Vulnerabilities
| CVE | Issue |
|---|---|
| CVE-2026-56846 | HTTP/2 memory limit bypass |
| CVE-2026-56848 | HTTP/2 heap use-after-free |
| CVE-2026-58043 | Filesystem permission bypass |
| CVE-2026-56850 | mTLS identity reuse |
| CVE-2026-58040 | Hostname verification bypass |
| CVE-2026-58041 | SQLite write re-execution |
| CVE-2026-58042 | DNS response crash |
| CVE-2026-58045 | zlib crash |
| CVE-2026-56847 | Trace events allowlist bypass |
| CVE-2026-58039 | Process report allowlist bypass |
| CVE-2026-58044 | HTTP request smuggling |
Node.js has also resolved lower-severity Permission Model bypasses related to trace-event logs and process reports, identified as CVE-2026-56847 and CVE-2026-58039. Both vulnerabilities could allow writing files outside of paths authorized by --allow-fs-write.
Finally, CVE-2026-58044 fixes an issue with HTTP header truncation that could enable request smuggling in Node.js – based forwarding proxies. js-based forwarding proxies.
Administrators are urged to upgrade immediately, test production dependencies, and retire unsupported Node.js versions, as these remain vulnerable when security flaws are disclosed.
