By ByteBot
Node.js shipped HIGH-severity patches today across all three active release lines — 22.x, 24.x, and 26.x. Three CVEs, three different attack surfaces: an HTTP server crash triggered by a single malformed header, a TLS exploit that can drop any HTTPS server using SNI, and a permission model sandbox escape that lets restricted code read files it was never supposed to touch. If you run Node.js in production, this is not a “schedule it for next week” release.
What’s Fixed
| CVE | Severity | Attack Surface | Impact |
|---|---|---|---|
| CVE-2026-21710 | HIGH (CVSS 7.5) | Any HTTP server using req.headersDistinct | Remote process crash (DoS) |
| CVE-2026-21637 | HIGH (CVSS 7.5) | TLS servers with SNICallback, pskCallback, or ALPNCallback | Remote process crash (DoS) |
| CVE-2026-58043 | HIGH (CVSS 8.4) | Apps using --permission or --experimental-permission | Sandbox escape, unauthorized file access |
CVE-2026-21710: The __proto__ Header That Crashes Your Server
This one has the widest blast radius. An attacker sends a single HTTP request with a header named __proto__. Node.js’s internal headersDistinct property getter resolves dest["__proto__"] to Object.prototype instead of undefined, then calls .push() on it. The result is a TypeError that fires synchronously inside a getter — standard error event listeners cannot intercept it. The process crashes.
What makes this particularly bad: there’s no reliable userland fix. Wrapping your own req.headersDistinct accesses in try/catch doesn’t protect you if any third-party middleware — Express plugins, logging libraries, request parsers — touches that property anywhere in the chain. Your only reliable mitigation before patching is blocking requests with __proto__ headers at the reverse proxy (nginx, Caddy, and HAProxy all support header filtering). Patch, then remove the rule.
CVE-2026-21637: The TLS Crash That Wouldn’t Stay Fixed
This is actually the third patch attempt for this bug family. January 2026 fixed the crash for pskCallback and ALPNCallback. The March release revealed SNICallback had the same missing try/catch in _tls_wrap.js. October 2026 closes the last gap.
If your server does HTTPS virtual hosting — routing different certificates to different domains based on the SNI extension — the SNI callback fires before any authentication, before any application code, before any of your error handlers are in scope. A crafted TLS handshake triggers a synchronous throw from that callback, it propagates as an uncaught exception, and the process crashes. Multi-tenant SaaS platforms and API gateways doing programmatic certificate selection should treat this as priority one.
CVE-2026-58043: Your Permission Sandbox Has a Hole
The Node.js permission model (--permission in Node 26, --experimental-permission in earlier lines) stores allowed filesystem paths in a radix tree. The bug lives in the tree’s insert logic: when adding a path forces a node to split — because two paths share a prefix — the shared-prefix node was incorrectly marked as a granted endpoint.
The upstream regression test makes the problem concrete. Grant read access to /secret1 and /secret2. The tree splits at /secret, which is now implicitly granted. Sandboxed code can now read the file /secret — a file you never allowlisted. In a Kubernetes pod this means: allowlist /var/run/secrets/token-a and /var/run/secrets/token-b, and /var/run/secrets/token (your service account credential) becomes readable to sandboxed code. CVSS 8.4 is the highest of the three because this is privilege escalation, not just denial of service.
How to Upgrade
# Check your current version
node --version
# nvm
nvm install --lts && nvm use --lts
# fnm
fnm install --lts && fnm use --lts
# Confirm the upgrade
node --versionFor Docker, pull the latest official image for your release line once patched versions appear on Docker Hub — official Node.js images track upstream releases quickly. Verify the exact patched version numbers on the official Node.js security advisory as releases land throughout the day. Check endoflife.date/nodejs for the full version support matrix.
Node 20 Is EOL — No Patch Is Coming
Node.js 20 reached end of life in April 2026. All three CVEs apply to it. There will be no official patch. The active supported lines are 22 (Maintenance LTS through April 2027), 24 (Maintenance LTS through April 2028), and 26 — which enters Active LTS status on October 28, one week from today. This security release is the last patch Node 26 receives before that promotion. If you’ve been planning a version migration, today gives you every reason to move it forward.
ByteIota covered what changes when Node 26 hits LTS two days ago — the feature timeline is there. Today’s story is simpler: check node --version, upgrade your active lines, and make sure your EOL migration is on the board.
