Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5828 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Node.js HTTP/2 Crash Signatures — Remote Abort, UAF and NULL-Deref (CVE-2026-123863, -123874, -123875, -123862)

Finds Node.js crash output tied to the November 2026 HTTP/2 flaws: the CHECK_EQ(current_nghttp2_memory_, 0) abort in ~Http2Session() (CVE-2026-123863, any client can abort a default 24.x/26.x server; variant of CVE-2024-27983), SIGSEGV in Http2Stream (use-after-free on a reset respondWithFile() stream, CVE-2026-123874), SIGSEGV in StreamPipe (NULL dereference on a cancelled download, CVE-2026-123875) and ERR_INTERNAL_ASSERTION (zlib params()+destroy(), CVE-2026-123862). One hit on an internet-facing host is a strong sign of remote crash attempts (T1499.004) against an unpatched build (T1190).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1499.004, T1499, T1190
• Data sources: linux_syslog, journald, nodejs_stderr
• Severity: high
• Confidence: high

Splunk SPL

index=os (sourcetype=syslog OR sourcetype=journald) earliest=-24h ("CHECK_EQ(current_nghttp2_memory_, 0)" OR "ERR_INTERNAL_ASSERTION" OR ("Http2Session" AND "Assertion") OR (("Http2Stream" OR "StreamPipe") AND ("SIGSEGV" OR "Segmentation fault")))
| eval crash_marker=case(like(_raw,"%current_nghttp2_memory_%"),"http2_session_abort_CVE-2026-123863", like(_raw,"%ERR_INTERNAL_ASSERTION%"),"internal_assertion_CVE-2026-123862", like(_raw,"%StreamPipe%"),"streampipe_null_deref_CVE-2026-123875", like(_raw,"%Http2Stream%"),"http2stream_uaf_CVE-2026-123874", true(),"http2_assertion")
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(crash_marker) AS markers BY host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("current_nghttp2_memory_", "ERR_INTERNAL_ASSERTION")
    or (SyslogMessage has "Http2Session" and SyslogMessage has "Assertion")
    or (SyslogMessage has_any ("Http2Stream", "StreamPipe") and SyslogMessage has_any ("SIGSEGV", "Segmentation fault"))
| extend CrashMarker = case(
    SyslogMessage has "current_nghttp2_memory_", "http2_session_abort_CVE-2026-123863",
    SyslogMessage has "ERR_INTERNAL_ASSERTION", "internal_assertion_CVE-2026-123862",
    SyslogMessage has "StreamPipe", "streampipe_null_deref_CVE-2026-123875",
    SyslogMessage has "Http2Stream", "http2stream_uaf_CVE-2026-123874",
    "http2_assertion")
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Computer, CrashMarker
| project Computer, CrashMarker, Events, FirstSeen, LastSeen

Sigma

title: Node.js HTTP/2 Session Assertion Abort or Stream Crash (CVE-2026-123863)
id: 3b0d6a52-5828-4c1e-9a01-7f2e4d9b0001
status: experimental
description: Detects Node.js crash output in host logs, namely the CHECK_EQ(current_nghttp2_memory_, 0) abort from ~Http2Session(), ERR_INTERNAL_ASSERTION, or SIGSEGV in Http2Stream/StreamPipe. These are crash indicators for the November 2026 remotely triggerable HTTP/2 bugs (CVE-2026-123863, CVE-2026-123874, CVE-2026-123875, CVE-2026-123862).
references:
    - https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
    - https://cna.openjsf.org/security-advisories.html
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-123864
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.impact
    - attack.t1499.004
    - attack.t1499
    - attack.initial-access
    - attack.t1190
    - cve.2026.123863
    - cve.2026.123874
    - cve.2026.123875
logsource:
    product: linux
    service: syslog
detection:
    kw_abort:
        - 'current_nghttp2_memory_'
        - 'ERR_INTERNAL_ASSERTION'
    kw_stream:
        - 'Http2Stream'
        - 'StreamPipe'
    kw_segv:
        - 'SIGSEGV'
        - 'Segmentation fault'
    condition: kw_abort or (kw_stream and kw_segv)
falsepositives:
    - Application bugs that legitimately raise ERR_INTERNAL_ASSERTION
    - Developer or QA hosts running debug builds of Node.js
    - Native addons that crash alongside HTTP/2 stream handling
level: high

Known false positives:

• Application bugs that legitimately trigger ERR_INTERNAL_ASSERTION
• Debug or QA builds of Node.js with assertion-heavy tests
• Native addon crashes that mention Http2Stream in the same log line

Tuning notes: Point the index and sourcetype at wherever Node.js stderr is collected (journald, container logs). Add known test hosts to an exclusion lookup. Correlate with preceding HTTP/2 connections from one source IP to identify the client, and confirm the running version is below 22.23.5, 24.22.3 or 26.13.1.

• 🔒 [indicator].js Service Crash / Memory-Exhaustion Loop — Exploitation DoS (CVE-2026-123863, CVE-2026-126051, CVE-2026-123868, CVE-2026-123865) · unlock with TL Creds
• 🔒 [indicator].js-Spawned Process Handling TLS Private Keys — Post-Exploitation (CVE-2026-123864) · unlock with TL Creds
• 🔒 Traffic To/From Related [indicator].js Exploitation Source [indicator] — Network Hunt (CVE-2026-111497) · unlock with TL Creds
• 🔒 Oversized Web Request / Source [indicator] Against [indicator].js — Exploitation Hunt (CVE-2026-111497) · unlock with TL Creds
• 🔒 [indicator].js Permission Model Wildcard fs Grant — Post-Exploitation Exposure (CVE-2026-106071, CVE-2026-123829) · unlock with TL Creds
• 🔒 [indicator].js Process Spawning Shell or Download/Netcat Tooling — Post-Exploitation C2 Staging (Node2Shell, CVE-2026-111497) · unlock with TL Creds
• 🔒 [indicator].js ERR_PROXY_INVALID_CONFIG Proxy Credential Disclosure — Post-Exploitation (CVE-2026-123871) · unlock with TL Creds
• 🔒 mTLS Client Certificate Reused Across Multiple SNI Hosts — Auth Bypass / Lateral Abuse (CVE-2026-123872, CVE-2026-123867, CVE-2026-123877) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5828.

Sample indicators (1 of 7)

• IP address: 94.154.43[.]7

Defanged, TLP:CLEAR. Full set of 7 indicators: unlock with TL Creds.

Technical analysis

On 2026-11-11 the Node.js Project published its November 2026 security releases for the 22.x, 24.x and 26.x lines (v22.23.5, v24.22.3, v26.13.1), together with updates to the bundled llhttp (22.x/24.x/26.x), undici (24.x/26.x) and sqlite (22.x/24.x) dependencies. The official advisory lists 16 CVEs: 7 high, 6 medium and 3 low. End-of-life Node.js versions are always affected and receive no fix.

HTTP/2 (most serious cluster): CVE-2026-123863 is a reachable assertion (CHECK_EQ(current_nghttp2_memory_, 0) in ~Http2Session()) that lets any client abort a default 24.x/26.x server; it is a variant of CVE-2024-27983 that the earlier fix missed. CVE-2026-123865 leaves sessions and sockets (CLOSE_WAIT) uncleaned after a protocol error during shutdown (incomplete fix of CVE-2026-48937), leaking memory and file descriptors. CVE-2026-123866 is a use-after-free in stream teardown that can send freed response memory to the peer. CVE-2026-123874 is a use-after-free of Http2Stream when a respondWithFile() stream is reset during a pending write. CVE-2026-123875 is a NULL dereference in StreamPipe when a respondWithFile() download is cancelled. CVE-2026-123828 is a one-byte heap overflow in session.altsvc() with a long origin (:authority). CVE-2026-123868 lets queued inbound data bypass the maxSessionMemory accounting (about 10 wire bytes per frame retain about 114 bytes), enabling memory exhaustion.

HTTPS/TLS: CVE-2026-123864 (NVD CVSS 3.0 8.1, CWE-416) is a re-entrancy bug where a zero-length TLS write in TLSWrap::DoWrite(), issued from the HTTP parser's on_body callback, re-enters llhttp_execute(), causing a use-after-free and out-of-bounds heap read; leaked server heap (potentially including TLS private keys and other users' requests) can end up in a response. It requires a handler that calls res.flushHeaders() before the request body ends and later res.end() with a non-empty chunk, plus a route that echoes or stores request bodies; cleartext node:http is not affected. CVE-2026-126051 allows a remote unauthenticated crash of TLS servers that use SNICallback, OCSPRequest, newSession, resumeSession or server.addContext() because a deferred callback runs after the socket is destroyed. CVE-2026-123872 lets a client change the servername during TLS 1.2 renegotiation and carry its client-certificate authentication over to a host with a stricter policy. CVE-2026-123867 makes CA-only SNI client-CA overrides fail open to the default CA (per-host mTLS bypass). CVE-2026-123877 allows https.Agent TLS session reuse across trust policies (ca omitted vs ca: []), bypassing certificate validation.

Other: CVE-2026-123871 discloses proxy credentials in ERR_PROXY_INVALID_CONFIG messages (incomplete fix of CVE-2026-48615). Low severity: CVE-2026-123829 (Permission Model bypass in recursive fs.watch on macOS/Windows leaking denied descendant names), CVE-2026-106071 (Permission Model filesystem over-grant via wildcard radix lookup, e.g. --allow-fs-read=/etc/passwd.* also allows /etc/passwd) and CVE-2026-123862 (zlib params()+destroy() throws an uncatchable ERR_INTERNAL_ASSERTION).

Several issues were reported by Chris Rohlf with Claude and Anthropic Research (CVE-2026-123863, -123864, -123874, -123875, -123862). The sources do not report in-the-wild exploitation or public PoC for these 16 CVEs. Separately, CVE-2026-111497 (Brotli decoder flaw, 'Node2Shell', CVSS 9.2) was added to CISA KEV on 2026-10-27 and was fixed in the October releases (22.23.4, 24.22.1, 26.12.1); it is a different issue but affects the same estate and should be patched in the same cycle.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials; T1552.004 Unsecured Credentials: Private Keys

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Remediation

Patches

• Node.js v22.23.5
• Node.js v24.22.3
• Node.js v26.13.1
• Bundled llhttp, undici and sqlite dependency updates

Immediate actions

• Upgrade to Node.js v22.23.5, v24.22.3 or v26.13.1 and restart all services
• If patching is delayed, limit public exposure of HTTP/2 and file-serving (respondWithFile/respondWithFD) endpoints
• Avoid reflecting :authority values into session.altsvc()
• Treat TLS private keys on HTTPS servers matching the CVE-2026-123864 pattern as potentially exposed and consider rotating them

Workarounds

• Disable TLS 1.2 renegotiation paths where client-certificate policy differs by servername
• Do not echo or store request bodies in handlers that call res.flushHeaders() before the body ends
• Sanitize proxy URLs and do not log ERR_PROXY_INVALID_CONFIG messages containing credentials

Longer-term hardening

• Migrate off end-of-life Node.js lines (EOL versions are always affected)
• Monitor Node.js security releases and the OpenJS CNA advisory feed
• Rely on per-host mTLS enforcement only after validating SNI/renegotiation behaviour post-patch

Affected and fixed versions

• OpenJS Foundation — Node.js
  Vulnerable versions: 22.x before 22.23.5; 24.x before 24.22.3; 26.x before 26.13.1; All end-of-life lines
  Fixed in: 22.23.5; 24.22.3; 26.13.1

Timeline

• 2024-04-01 CVE-2024-27983 (HTTP/2 assertion crash) fixed earlier; CVE-2026-123863 is a variant the earlier fix missed
• 2026-10-26 A 23,069,983-byte exploitation request from locked-ioc-2 targeting Node.js 24.22.0 (Brotli flaw CVE-2026-111497, a separate issue) was observed
• 2026-10-27 CISA added the related Brotli flaw CVE-2026-111497 to KEV (federal deadline 2026-11-10); October Node.js batch patched it in 22.23.4, 24.22.1, 26.12.1
• 2026-11-11 NVD published CVE-2026-123864 (CVSS 3.0 8.1, CWE-416) referencing the OpenJS CNA advisory
• 2026-11-11 Node.js released v22.23.5, v24.22.3 and v26.13.1 fixing 16 vulnerabilities (7 high, 6 medium, 3 low) plus llhttp, undici and sqlite updates
• 2026-11-12 GBHackers reported the 16 Node.js vulnerabilities; no in-the-wild exploitation or public PoC stated for these CVEs

Sources cited

• NVD: CVE-2026-123864 NVD (NIST) · Advisory · 2026-11-11
• OpenJS CNA Security Advisories cna.openjsf.org · Advisory · 2026-11-11
• Node.js Security Releases: November 11, 2026 nodejs.org · Vendor report · 2026-11-11
• GBHackers: Node.js Patches 16 Security Vulnerabilities Allowing Remote Server Crashes, Memory Leaks, and Authentication Bypass gbhackers.com · News · 2026-11-12
• GBHackers: CISA Warns of Node2Shell RCE Vulnerability in Node.js (CVE-2026-111497, related Brotli flaw) gbhackers.com · News · 2026-10-27
• GBHackers: Node.js Patches 10 Security Vulnerabilities (October batch) gbhackers.com · News · 2026-10-27

More in vulnerability

• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Dirty Cert: Cisco Smart Software Manager Silently Patched Post-Auth RCE via Certificate Upload (no CVE stated)
• OpenCode Remote Code Execution via /global/upgrade Content-Type Confusion and Cross-Site Request (GHSA-632h-h47v-g4x4)
• Multiple Windows Remote Desktop Client Vulnerabilities Allow Code Execution (CVE-2026-119934, CVE-2026-119858, CVE-2026-119390, CVE-2026-95964)