The Node.js project has released important security updates addressing 11 vulnerabilities across its active branches: 22.x, 24.x, and 26.x.

The updates are now available as Node.js versions v22.23.2, v24.18.1, and v26.5.1. The July 2026 security release includes fixes for vulnerabilities related to HTTP/2 processing, the Permission Model, HTTPS connection reuse, DNS resolution, SQLite handling, Zlib APIs, and the HTTP parser.

Additionally, Node.js has updated its bundled Undici dependency to versions 8.9.0, 7.29.0, and 6.28.0, depending on the release line, along with the llhttp dependency to version 9.4.3. Two high-severity HTTP/2 vulnerabilities could potentially allow remote attackers to disrupt Node.js services.

CVE-2026-56846 enables retained HTTP/2 header blocks to bypass the configured maxSessionMemory limit. An attacker could send specially crafted traffic that consumes server memory, leading to a denial-of-service condition.

CVE-2026-56848 is another high-severity HTTP/2 issue affecting all active release lines. This vulnerability can trigger a heap use-after-free condition when the underlying nghttp2 library processes data while simultaneously receiving additional data.

Such memory safety issues can crash a process and may have broader security implications depending on runtime conditions. The update also addresses CVE-2026-58043, a high-severity vulnerability in the Node.js Permission Model.

Node.js Fixes Security Flaws

Applications launched with the --permission option could mistakenly grant filesystem access outside the intended allowlist due to problems in radix-tree prefix boundary handling. This flaw allows a user with access to an approved path to potentially read or write files in unintended locations.

Several medium-severity bugs affect HTTPS and overall application reliability. CVE-2026-56850 could result in HTTPS Agents reusing mutual TLS identities across requests with different PFX certificates. CVE-2026-58040 corrects an incomplete earlier patch that could permit TLS session reuse to bypass hostname verification across identity policies.

Other fixes aim to prevent crashes caused by oversized DNS responses and manipulated TypedArray lengths. CVE-2026-58042 can cause dns.resolveAny() to abort when the response contains more than 256 A records, while CVE-2026-58045 can crash synchronous Node:zlib APIs when using a spoofed TypedArray byte length.

Patched Vulnerabilities

CVE	Issue
CVE-2026-56846	HTTP/2 memory limit bypass
CVE-2026-56848	HTTP/2 heap use-after-free
CVE-2026-58043	Filesystem permission bypass
CVE-2026-56850	mTLS identity reuse
CVE-2026-58040	Hostname verification bypass
CVE-2026-58041	SQLite write re-execution
CVE-2026-58042	DNS response crash
CVE-2026-58045	zlib crash
CVE-2026-56847	Trace events allowlist bypass
CVE-2026-58039	Process report allowlist bypass
CVE-2026-58044	HTTP request smuggling

Node.js has also resolved lower-severity Permission Model bypasses related to trace-event logs and process reports, identified as CVE-2026-56847 and CVE-2026-58039. Both vulnerabilities could allow writing files outside of paths authorized by --allow-fs-write.

Finally, CVE-2026-58044 fixes an issue with HTTP header truncation that could enable request smuggling in Node.js – based forwarding proxies. js-based forwarding proxies.

Administrators are urged to upgrade immediately, test production dependencies, and retire unsupported Node.js versions, as these remain vulnerable when security flaws are disclosed.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Node.js Fixes 11 Security Flaws That Can Crash Servers and Break Filesystem Restrictions appeared first on Cyber Security News.