- 12th November 2026
Node.js fixed 16 runtime vulnerabilities on November 11, 2026, and 7 are High. CVE-2026-123864 can leak TLS private keys and other users’ requests from HTTPS servers. CVE-2026-123863 crashes a default HTTP/2 server with one unauthenticated request. There is no workaround: upgrade to 22.23.5, 24.22.3 or 26.13.1.
Daniel Reeves


















