Skip to content
High-Risk Vulnerabilities Disclosed in Node.js Releases

High-Risk Vulnerabilities Disclosed in Node.js Releases

First seen 11 Nov 2026, 22:13 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 11, 2026 at 22:14 UTC
  • •Node.js versions 24.22.3 and 26.13.1 released patches for multiple high-severity vulnerabilities.
  • •CVE-2026-123863 and CVE-2026-123864 are critical with CVSS scores of 8.2 and 8.1.
  • •Immediate patching is recommended to prevent potential exploitation of these vulnerabilities.

On November 11, 2026, Node.js released updates for versions 24.22.3 and 26.13.1, addressing multiple high-severity vulnerabilities. Key issues include CVE-2026-123863 and CVE-2026-123864, both rated high with CVSS scores of 8.2 and 8.1 respectively, which could allow for significant security risks if exploited. Other vulnerabilities, such as CVE-2026-123865 and CVE-2026-123866, also pose serious threats, with potential impacts on HTTP/2 and TLS functionalities. The vulnerabilities affect various Node.js implementations, and users are urged to update their systems promptly. All CVEs were published on the same day as the release, indicating a coordinated disclosure and patching effort. The vulnerabilities could lead to issues like stream management failures and potential denial of service. Users should prioritize applying the patches to mitigate risks associated with these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-11-11
Node.js releases updates
Node.js released versions 24.22.3 and 26.13.1 addressing multiple vulnerabilities including CVE-2026-123863 and CVE-2026-123864.
nodejs.org
2026-11-11
CVE disclosures published
Multiple CVEs including CVE-2026-123863, CVE-2026-123864, and others were published with high severity ratings.
nodejs.org
2026-11-11
CVE-2026-123863 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-11
CVE-2026-123864 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-11
CVE-2026-123865 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-11
CVE-2026-123866 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (2)

Following this threat?

Track CVE-2026-123828 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 2

Common questions

Which Node.js versions are affected?
Node.js versions 24.22.3 and 26.13.1 are affected by multiple high-severity vulnerabilities.
What should I do to protect my systems?
Apply the latest patches for Node.js immediately to mitigate the risks associated with the disclosed vulnerabilities.
Are these vulnerabilities being actively exploited?
Currently, there are no reports of active exploitation for these vulnerabilities, but immediate patching is advised.