Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass, TLS/mTLS Issues) — Threadlinqs Intelligence
As of 2026-08-01, Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass, TLS/mTLS Issues) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 34 indicators of compromise.
Threat ID: TL-2026-1807 · Severity: HIGH · CVSS: 7.5 · Status: PATCHED · Category: VULNERABILITY
Node.js released v22.23.2, v24.18.1, and v26.5.1 on 2026-07-29 fixing 11 CVEs, including three HIGH-severity issues: an HTTP/2 flaw letting retained header blocks bypass maxSessionMemory limits
On 2026-07-29 the Node.js Security Release Working Group published coordinated security releases for all three active release lines — v22.23.2 (LTS 'Jod'), v24.18.1 (LTS), and v26.5.1 (Current) — fixing 11 CVEs. The releases also bumped llhttp to 9.4.3 across all three lines and undici to 8.9.0 (v26.x) / 7.29.0 (v24.x) / 6.28.0 (v22.x). v22.23.2 ships 10 of the 11 fixes; CVE-2026-58041 (node:sqlite) does not apply to the 22.x line. The release itself slipped twice from its original target: the Working Group pushed it from ~2026-07-27 to 2026-07-28 for additional testing/validation, then again from 2026-07-28 to the actual 2026-07-29 ship date due to release-pipeline infrastructure issues (per digitalapplied.com's release-timeline analysis). NVD confirms the affected-version ceiling precisely: Node.js main, 22.23.1 and earlier, 24.18.0 and earlier, and 26.5.0 and earlier are vulnerable to CVE-2026-58043.
The three HIGH-severity issues center on the HTTP/2 implementation and the Permission Model sandbox. CVE-2026-56846 (reported by leduckhuong, fixed by Matteo Collina, commit 'retain header memory in session accounting') lets an attacker send crafted HTTP/2 traffic whose retained header blocks evade the configured maxSessionMemory limit, exhausting server memory and causing denial of service. CVE-2026-56848 (reported by hahahkim, fixed by Matteo Collina, commit 'defer rst stream while in scope') is a heap-use-after-free triggered when nghttp2_session_mem_send() executes re-entrantly while nghttp2_session_mem_recv() is still processing incoming data — independent analysis (digitalapplied.com) characterizes this as a crash/RCE-class memory-safety bug in a network-facing parser. CVE-2026-58043 (reported by sy2n0, fixed by RafaelGSS, commit 'avoid granting radix split nodes') is a boundary-handling flaw in the radix-tree structure backing the --permission flag's path-matching logic: code already permitted access to one filesystem path can abuse the boundary handling to read from or write to paths outside the intended --allow-fs-read/--allow-fs-write allowlist. This is the only one of the three HIGH CVEs with a public numeric score at release time: CVSS 7.5 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, CWE-284 Improper Access Control), per NVD/HackerOne.
The five MEDIUM-severity issues: CVE-2026-56850 (reported by yottt, fixed by RafaelGSS) — the HTTPS Agent reuses TLS client identities across requests presenting different PFX certificates because of object-array agent-key collisions. CVE-2026-58040 (reported by vnyuh, fixed by Matteo Collina) — an incomplete fix for the earlier CVE-2026-48934 still allows TLS session reuse to skip hostname verification across differing security policies. CVE-2026-58041 (reported by cantina-security, fixed by Matteo Collina, nodejs-private/node-private PR #896) — node:sqlite's StatementSyncIterator objects, created through DatabaseSync#createTagStore(), are not invalidated on statement reset/rebind because the SQLTagStore cache resets statements by calling sqlite3_reset() directly rather than going through the iterator-invalidation path, so a stale iterator can replay a cached prepared statement and re-execute writes with new bound parameters — a data-integrity risk (unintended re-execution of INSERT/UPDATE/DELETE) rather than pure disclosure. CVE-2026-58042 (reported by cantina-security, fixed by RafaelGSS) — dns.resolveAny() can abort when a DNS response contains more than 256 A records, enabling a repeatable crash-based DoS. CVE-2026-58045 (reported by byvini, fixed by RafaelGSS) — a spoofed TypedArray.byteLength triggers a reachable assertion inside node:zlib's synchronous APIs, crashing the process.
The three LOW-severity issues are all further Permission Model boundary gaps plus an HTTP parser issue: CVE-2026-56847 (reported by 0xoroot, fixed by RafaelGSS) — trace_events.createTracing().enable() can write trace logs outside the --allow-fs-write allowlist. CVE-2026-58039 (reported by sinan-p
Weaknesses (CWE)
CWE-284, CWE-400, CWE-416, CWE-295, CWE-297, CWE-672, CWE-20, CWE-617, CWE-668, CWE-444
Target sectors: technology, cloud-hosting-saas, ecommerce, financial-services, government administration, health, telecoms, media-and-entertainment
Target regions: Global
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 34 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-56846, CVE-2026-56847, CVE-2026-56848, CVE-2026-56850, CVE-2026-58039, CVE-2026-58040, CVE-2026-58041, CVE-2026-58042, CVE-2026-58043, CVE-2026-58044, T1592, T1595, T1588, T1518, T1082, T1190, T1059, T1210, T1548, T1068
