# Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

> The Node.js Project shipped v22.23.5, v24.22.3 and v26.13.1 on 2026-11-11 fixing 16 vulnerabilities (7 high, 6 medium, 3 low). The flaws include remotely triggerable HTTP/2 crashes and use-after-free bugs, an HTTPS re-entrancy bug that leaks other connections' heap memory (potentially TLS private keys), and TLS client-certificate authentication bypasses.

- **Published:** 2026-11-12T05:35:51Z
- **Last reviewed:** 2026-11-12T05:35:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5828
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5828.png
- **ID:** TL-2026-5828
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7 (1 shown free below)
- **CVEs:** CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-126051, CVE-2026-123872, CVE-2026-123874, CVE-2026-123828, CVE-2026-123867, CVE-2026-123868, CVE-2026-123871, CVE-2026-123877, CVE-2026-123875, CVE-2026-123829, CVE-2026-123862, CVE-2026-106071, CVE-2026-111497

## Description

On 2026-11-11 the Node.js Project published its November 2026 security releases for the 22.x, 24.x and 26.x lines (v22.23.5, v24.22.3, v26.13.1), together with updates to the bundled llhttp (22.x/24.x/26.x), undici (24.x/26.x) and sqlite (22.x/24.x) dependencies. The official advisory lists 16 CVEs: 7 high, 6 medium and 3 low. End-of-life Node.js versions are always affected and receive no fix.

HTTP/2 (most serious cluster): CVE-2026-123863 is a reachable assertion (CHECK_EQ(current_nghttp2_memory_, 0) in ~Http2Session()) that lets any client abort a default 24.x/26.x server; it is a variant of CVE-2024-27983 that the earlier fix missed. CVE-2026-123865 leaves sessions and sockets (CLOSE_WAIT) uncleaned after a protocol error during shutdown (incomplete fix of CVE-2026-48937), leaking memory and file descriptors. CVE-2026-123866 is a use-after-free in stream teardown that can send freed response memory to the peer. CVE-2026-123874 is a use-after-free of Http2Stream when a respondWithFile() stream is reset during a pending write. CVE-2026-123875 is a NULL dereference in StreamPipe when a respondWithFile() download is cancelled. CVE-2026-123828 is a one-byte heap overflow in session.altsvc() with a long origin (:authority). CVE-2026-123868 lets queued inbound data bypass the maxSessionMemory accounting (about 10 wire bytes per frame retain about 114 bytes), enabling memory exhaustion.

HTTPS/TLS: CVE-2026-123864 (NVD CVSS 3.0 8.1, CWE-416) is a re-entrancy bug where a zero-length TLS write in TLSWrap::DoWrite(), issued from the HTTP parser's on_body callback, re-enters llhttp_execute(), causing a use-after-free and out-of-bounds heap read; leaked server heap (potentially including TLS private keys and other users' requests) can end up in a response. It requires a handler that calls res.flushHeaders() before the request body ends and later res.end() with a non-empty chunk, plus a route that echoes or stores request bodies; cleartext node:http is not affected. CVE-2026-126051 allows a remote unauthenticated crash of TLS servers that use SNICallback, OCSPRequest, newSession, resumeSession or server.addContext() because a deferred callback runs after the socket is destroyed. CVE-2026-123872 lets a client change the servername during TLS 1.2 renegotiation and carry its client-certificate authentication over to a host with a stricter policy. CVE-2026-123867 makes CA-only SNI client-CA overrides fail open to the default CA (per-host mTLS bypass). CVE-2026-123877 allows https.Agent TLS session reuse across trust policies (ca omitted vs ca: []), bypassing certificate validation.

Other: CVE-2026-123871 discloses proxy credentials in ERR_PROXY_INVALID_CONFIG messages (incomplete fix of CVE-2026-48615). Low severity: CVE-2026-123829 (Permission Model bypass in recursive fs.watch on macOS/Windows leaking denied descendant names), CVE-2026-106071 (Permission Model filesystem over-grant via wildcard radix lookup, e.g. --allow-fs-read=/etc/passwd.* also allows /etc/passwd) and CVE-2026-123862 (zlib params()+destroy() throws an uncatchable ERR_INTERNAL_ASSERTION).

Several issues were reported by Chris Rohlf with Claude and Anthropic Research (CVE-2026-123863, -123864, -123874, -123875, -123862). The sources do not report in-the-wild exploitation or public PoC for these 16 CVEs. Separately, CVE-2026-111497 (Brotli decoder flaw, 'Node2Shell', CVSS 9.2) was added to CISA KEV on 2026-10-27 and was fixed in the October releases (22.23.4, 24.22.1, 26.12.1); it is a different issue but affects the same estate and should be patched in the same cycle.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1212 Exploitation for Credential Access
- T1552.004 Unsecured Credentials: Private Keys
- T1552 Unsecured Credentials

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Node.js HTTP/2 Crash Signatures — Remote Abort, UAF and NULL-Deref (CVE-2026-123863, -123874, -123875, -123862)** (`TL-2026-5828-SPL-001`)

Finds Node.js crash output tied to the November 2026 HTTP/2 flaws: the CHECK_EQ(current_nghttp2_memory_, 0) abort in ~Http2Session() (CVE-2026-123863, any client can abort a default 24.x/26.x server; variant of CVE-2024-27983), SIGSEGV in Http2Stream (use-after-free on a reset respondWithFile() stream, CVE-2026-123874), SIGSEGV in StreamPipe (NULL dereference on a cancelled download, CVE-2026-123875) and ERR_INTERNAL_ASSERTION (zlib params()+destroy(), CVE-2026-123862). One hit on an internet-facing host is a strong sign of remote crash attempts (T1499.004) against an unpatched build (T1190).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1499.004, T1499, T1190
- **Data sources:** linux_syslog, journald, nodejs_stderr
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=os (sourcetype=syslog OR sourcetype=journald) earliest=-24h ("CHECK_EQ(current_nghttp2_memory_, 0)" OR "ERR_INTERNAL_ASSERTION" OR ("Http2Session" AND "Assertion") OR (("Http2Stream" OR "StreamPipe") AND ("SIGSEGV" OR "Segmentation fault")))
| eval crash_marker=case(like(_raw,"%current_nghttp2_memory_%"),"http2_session_abort_CVE-2026-123863", like(_raw,"%ERR_INTERNAL_ASSERTION%"),"internal_assertion_CVE-2026-123862", like(_raw,"%StreamPipe%"),"streampipe_null_deref_CVE-2026-123875", like(_raw,"%Http2Stream%"),"http2stream_uaf_CVE-2026-123874", true(),"http2_assertion")
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(crash_marker) AS markers BY host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("current_nghttp2_memory_", "ERR_INTERNAL_ASSERTION")
    or (SyslogMessage has "Http2Session" and SyslogMessage has "Assertion")
    or (SyslogMessage has_any ("Http2Stream", "StreamPipe") and SyslogMessage has_any ("SIGSEGV", "Segmentation fault"))
| extend CrashMarker = case(
    SyslogMessage has "current_nghttp2_memory_", "http2_session_abort_CVE-2026-123863",
    SyslogMessage has "ERR_INTERNAL_ASSERTION", "internal_assertion_CVE-2026-123862",
    SyslogMessage has "StreamPipe", "streampipe_null_deref_CVE-2026-123875",
    SyslogMessage has "Http2Stream", "http2stream_uaf_CVE-2026-123874",
    "http2_assertion")
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Computer, CrashMarker
| project Computer, CrashMarker, Events, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Node.js HTTP/2 Session Assertion Abort or Stream Crash (CVE-2026-123863)
id: 3b0d6a52-5828-4c1e-9a01-7f2e4d9b0001
status: experimental
description: Detects Node.js crash output in host logs, namely the CHECK_EQ(current_nghttp2_memory_, 0) abort from ~Http2Session(), ERR_INTERNAL_ASSERTION, or SIGSEGV in Http2Stream/StreamPipe. These are crash indicators for the November 2026 remotely triggerable HTTP/2 bugs (CVE-2026-123863, CVE-2026-123874, CVE-2026-123875, CVE-2026-123862).
references:
    - https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
    - https://cna.openjsf.org/security-advisories.html
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-123864
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.impact
    - attack.t1499.004
    - attack.t1499
    - attack.initial-access
    - attack.t1190
    - cve.2026.123863
    - cve.2026.123874
    - cve.2026.123875
logsource:
    product: linux
    service: syslog
detection:
    kw_abort:
        - 'current_nghttp2_memory_'
        - 'ERR_INTERNAL_ASSERTION'
    kw_stream:
        - 'Http2Stream'
        - 'StreamPipe'
    kw_segv:
        - 'SIGSEGV'
        - 'Segmentation fault'
    condition: kw_abort or (kw_stream and kw_segv)
falsepositives:
    - Application bugs that legitimately raise ERR_INTERNAL_ASSERTION
    - Developer or QA hosts running debug builds of Node.js
    - Native addons that crash alongside HTTP/2 stream handling
level: high

```

**Known false positives:**

- Application bugs that legitimately trigger ERR_INTERNAL_ASSERTION
- Debug or QA builds of Node.js with assertion-heavy tests
- Native addon crashes that mention Http2Stream in the same log line

**Tuning notes:** Point the index and sourcetype at wherever Node.js stderr is collected (journald, container logs). Add known test hosts to an exclusion lookup. Correlate with preceding HTTP/2 connections from one source IP to identify the client, and confirm the running version is below 22.23.5, 24.22.3 or 26.13.1.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator].js Service Crash / Memory-Exhaustion Loop — Exploitation DoS (CVE-2026-123863, CVE-2026-126051, CVE-2026-123868, CVE-2026-123865) (locked: unlock with TL Creds)
- [indicator].js-Spawned Process Handling TLS Private Keys — Post-Exploitation (CVE-2026-123864) (locked: unlock with TL Creds)
- Traffic To/From Related [indicator].js Exploitation Source [indicator] — Network Hunt (CVE-2026-111497) (locked: unlock with TL Creds)
- Oversized Web Request / Source [indicator] Against [indicator].js — Exploitation Hunt (CVE-2026-111497) (locked: unlock with TL Creds)
- [indicator].js Permission Model Wildcard fs Grant — Post-Exploitation Exposure (CVE-2026-106071, CVE-2026-123829) (locked: unlock with TL Creds)
- [indicator].js Process Spawning Shell or Download/Netcat Tooling — Post-Exploitation C2 Staging (Node2Shell, CVE-2026-111497) (locked: unlock with TL Creds)
- [indicator].js ERR_PROXY_INVALID_CONFIG Proxy Credential Disclosure — Post-Exploitation (CVE-2026-123871) (locked: unlock with TL Creds)
- mTLS Client Certificate Reused Across Multiple SNI Hosts — Auth Bypass / Lateral Abuse (CVE-2026-123872, CVE-2026-123867, CVE-2026-123877) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 7)

Defanged, TLP:CLEAR.

- IP address: `94.154.43[.]7`

Full set of 7 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Node.js Security Releases: November 11, 2026](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases)
- [NVD: CVE-2026-123864](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-123864)
- [OpenJS CNA Security Advisories](https://cna.openjsf.org/security-advisories.html)
- [GBHackers: Node.js Patches 16 Security Vulnerabilities Allowing Remote Server Crashes, Memory Leaks, and Authentication Bypass](https://gbhackers.com/node-js-patches-16-security-vulnerabilities/)
- [GBHackers: CISA Warns of Node2Shell RCE Vulnerability in Node.js (CVE-2026-111497, related Brotli flaw)](https://gbhackers.com/cisa-warns-node2shell-rce-vulnerability-in-node-js/)
- [GBHackers: Node.js Patches 10 Security Vulnerabilities (October batch)](https://gbhackers.com/node-js-patches-10-security-vulnerabilities/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5828