Node.js Patches 3 HIGH CVEs — Update 22.x, 24.x, 26.x Now

Node.js shipped emergency security patches on July 29 for all three of its active release lines — 22.x, 24.x, and 26.x — fixing 11 CVEs, three rated HIGH. The most serious is a heap-use-after-free in the HTTP/2 stack that could slide from denial-of-service into remote code execution depending on memory layout. If your server speaks HTTP/2, this is not the patch you defer until next sprint.

The release was delayed two days from its originally scheduled date due to infrastructure issues on the Node.js project’s end — meaning CVE IDs were circulating before patches landed. Reason enough to move quickly.

The Three HIGH CVEs

CVE-2026-56848 — HTTP/2 Heap-Use-After-Free

This one affects all three active lines (22.x, 24.x, 26.x) and carries the highest risk profile. When nghttp2_session_mem_send() is called re-entrantly during an active nghttp2_session_mem_recv() call, the result is a heap-use-after-free condition. That translates to process crashes at minimum and, depending on how an attacker shapes the heap, potential remote code execution.

Node.js rated this HIGH rather than CRITICAL, and the exploit path is non-trivial. But heap-use-after-free bugs have a track record of being underestimated early on. If you’re running a public-facing HTTP/2 endpoint, patch now and debate severity later.

CVE-2026-56846 — HTTP/2 Memory Exhaustion

Affecting 22.x and 24.x (not 26.x), this lets an unauthenticated remote attacker bypass Node.js’s maxSessionMemory limit by retaining HTTP/2 header blocks in memory. The result: unbounded memory consumption and denial of service. No authentication required, no special conditions — just an HTTP/2 connection.

CVE-2026-58043 — Permission Model Path Escape

This is the subtle one. Node.js’s Permission Model (enabled with --permission) uses a radix tree to track which filesystem paths a process is allowed to access. A bug in how it handles prefix boundaries means a process granted access to /data/uploads could silently read or write to /data/uploads-private or adjacent paths it was never supposed to touch.

The Permission Model was stabilized precisely so teams could sandbox plugin code, user scripts, or third-party integrations at the process level. This flaw undermines that entirely. Consider it a reminder: the Permission Model is a useful layer, not an isolation guarantee.

Worth Knowing: Four Medium CVEs

Below the HIGH threshold, a few medium-severity bugs deserve attention depending on your stack:

• CVE-2026-58040 — TLS session reuse can skip hostname verification. This is a second attempt at fixing a prior vulnerability. If your app handles multiple TLS identities, review your HTTPS Agent configuration.
• CVE-2026-58041 — node:sqlite iterators can replay cached prepared statements after a reset, potentially re-executing write operations. Watch out if you use SQLite in data migration scripts.
• CVE-2026-58042 — dns.resolveAny() crashes the entire process if a DNS response contains more than 256 A records. One crafted response and your server is down.
• CVE-2026-58044 — HTTP header truncation hides framing-relevant headers like Content-Length, enabling request smuggling in proxy-forwarded deployments.

How to Update

The patched versions are 22.23.2, 24.18.1, and 26.5.1. Check what you’re running, then upgrade:

# Check your version
node --version

# nvm
nvm install 24.18.1
nvm use 24.18.1
nvm alias default 24.18.1

# fnm
fnm install 24.18.1 && fnm use 24.18.1

# Docker — pin your base image
# FROM node:24  →  FROM node:24.18.1

If you’re on an end-of-life Node.js version (anything below 22.x), there are no patches for your line. The fix is a migration, not a workaround. The Node.js project provides signed release artifacts with SHA256 checksums — if you’re in a regulated environment, verify the PGP signatures before deploying. Full details in the official security advisory.