Runtime vulnerability, severity high
Node.js security releases fix multiple high-severity HTTP/2, TLS and HTTPS flaws in 22.x, 24.x and 26.x
Published
Node.js released security updates for the 22.x, 24.x and 26.x lines covering multiple high-severity vulnerabilities. They include remote unauthenticated crashes, use-after-free memory disclosure in HTTP/2 and HTTPS (including TLS private keys and other users' requests), and TLS client certificate authentication bypasses. Medium and low issues include proxy credentials leaking into error messages and a certificate validation bypass in https.Agent.
What's affected
- node runtime>=22.0.0 <22.23.5; >=24.0.0 <24.22.3; >=26.0.0 <26.13.1
What to do
- Upgrade Node.js to v22.23.5, v24.22.3 or v26.13.1 depending on your release line.
- Move off end-of-life Node.js versions, which are always affected by security releases.
- If you use a proxy URL with credentials, check logs and crash reports for exposed proxy credentials and rotate them if needed.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it. The check is free and needs no account:
/pharon:check-incident nodejs-november-security-releases-2026-11References
Notice nodejs-november-security-releases-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.