{"name":"NODEJS_NOV_2026 - campaign","description":"# Executive Threat Brief — NODEJS_NOV_2026\n\n## Campaign Snapshot\n\nThe Node.js project released emergency fixes on November 11, 2026 for 16 vulnerabilities in the runtime itself, 7 of them High. Two unauthenticated flaws drive the risk: one can leak TLS private keys and other users' request data from a shared HTTPS process (CVE-2026-123864), and one crashes a default HTTP/2 server with a single request (CVE-2026-123863). Any Node.js process that terminates TLS or serves HTTP/2 to untrusted clients is in scope. No active exploitation is reported and no workaround exists; upgrading is the only fix.\n\n## What Is Affected\n\n### Software\n\n| Software | Vulnerable Version | Safe Version | Action |\n|----------|--------------------|--------------|--------|\n| Node.js 26.x | before 26.13.1 | 26.13.1 | Upgrade and restart |\n| Node.js 24.x (LTS) | before 24.22.3 | 24.22.3 | Upgrade and restart |\n| Node.js 22.x (LTS) | before 22.23.5 | 22.23.5 | Upgrade and restart |\n| Node.js 20.x, 25.x (EOL) | all | none | Migrate to a supported line |\n\n### Containers\n\n| Image | Vulnerable Tag | Safe Tag | Registry | Action |\n|-------|----------------|----------|----------|--------|\n| node | <26.13.1, <24.22.3, <22.23.5 and derived tags | 26.13.1 / 24.22.3 / 22.23.5 | docker.io/library | Rebuild and redeploy |\n\n### Libraries\n\n| Package | Ecosystem | Vulnerable Range | Safe Version | Action |\n|---------|-----------|------------------|--------------|--------|\n| node runtime | runtime | 22.x <22.23.5; 24.x <24.22.3; 26.x <26.13.1 | per-line fixed release | Upgrade the executing binary, not just the manifest |\n\n## Business Impact\n\n- Cross-tenant secret exposure: CVE-2026-123864 can disclose TLS private keys and other users' requests from a shared HTTPS process, enabling later interception or impersonation.\n- Service outage: CVE-2026-123863 allows a one-request, unauthenticated crash of default HTTP/2 servers, scriptable into a sustained denial of service.\n- Resource exhaustion: CVE-2026-123865 holds memory and file descriptors indefinitely, degrading hosts over time.\n- Authentication bypass: CVE-2026-123872 lets a client carry authentication into a stricter per-hostname mTLS policy via TLS 1.2 renegotiation.\n- Compliance exposure: potential TLS key disclosure may trigger key-rotation and breach-assessment obligations independent of patching.\n\n## Immediate Actions (Next 24-72 Hours)\n\n1. Inventory every Node.js process and record executing version, image digest, and listener type | Platform/AppSec | 24h\n2. Patch internet-exposed native HTTP/2 and HTTPS services to the fixed per-line release | Service owners | 48h\n3. Rebuild and redeploy affected container images; verify the running binary reports a fixed version | Platform | 72h\n4. Assess TLS key rotation for HTTPS servers matching the CVE-2026-123864 handler pattern | Security/IR | 72h\n5. Migrate EOL lines (20.x, 25.x) onto a supported runtime | Platform | tracked follow-up\n\n## Key IOCs (Fast Reference)\n\n| Type | Value | Context |\n|------|-------|---------|\n| CVE | CVE-2026-123864 | HTTPS heap memory disclosure, TLS private keys |\n| CVE | CVE-2026-123863 | HTTP/2 unauthenticated process crash |\n| CVE | CVE-2026-123866 | HTTP/2 cross-connection response-buffer disclosure |\n| CVE | CVE-2026-123865 | HTTP/2 memory and file-descriptor exhaustion |\n| CVE | CVE-2026-123874 | HTTP/2 use-after-free in respondWithFile / respondWithFD |\n| CVE | CVE-2026-126051 | TLS server uncaught exception via SNI/OCSP/session hooks |\n| CVE | CVE-2026-123872 | TLS 1.2 renegotiation mTLS hostname-policy bypass |\n| Signal | rising CLOSE_WAIT sockets, RSS and FD growth, assertion aborts | Runtime exhaustion/crash indicators |\n\n## Risk Summary\n\n| Dimension | Rating | Rationale |\n|-----------|--------|-----------|\n| Exploitability | High | Unauthenticated, network-reachable, default-config trigger for the crash; no credentials needed |\n| Blast Radius | High | Node.js runs a large share of internet-facing API and CI workloads |\n| Persistence Risk | Medium | No persistence primitive; leaked TLS keys enable durable follow-on access |\n| Remediation Complexity | Medium | Upgrade is straightforward; reachability triage and key-rotation decisions add effort |\n| Business Exposure | High | Potential secret disclosure and service outage on customer-facing services |\n"}