Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs

What to do

1. Run node -v on every host, container and CI image that serves traffic.
2. Upgrade to 26.5.1, 24.18.1 or 22.23.2 or later (nvm install 24.18.1, your OS packages, or refreshed node:* images), then restart processes.
3. Rebuild and redeploy container images and single executable applications so they embed the fixed runtime.
4. If you cannot upgrade yet and do not need HTTP/2, disable it on public listeners or terminate HTTP/2 at a proxy.
5. Move anything on an End-of-Life Node.js line to a supported LTS.

How to check if you are affected or compromised

• Compare node -v (or process.version in logs) against the fixed versions; anything lower is affected.
• Watch for Node.js HTTP/2 servers with unexplained memory growth or crashes under many concurrent streams or large header blocks.
• No exploitation has been reported; CISA's enrichment lists exploitation as none for the high-severity CVEs.

What happened#

On July 29, 2026, the Node.js project shipped security releases for all three supported lines: 26.5.1 (Current), 24.18.1 (LTS) and 22.23.2 (LTS). The releases fix 11 CVEs: three high, five medium and three low. They also update llhttp to 9.4.3 and update undici. The 24.18.1 notes list undici 7.29.0, and the 22.23.2 notes list 6.28.0. The release had been planned for July 28 and was postponed twice, first for more testing and then for infrastructure problems.

The three high-severity fixes:

• CVE-2026-56848: in HTTP/2 handling, nghttp2_session_mem_send() could be called re-entrantly while nghttp2_session_mem_recv() was running, causing a heap use-after-free. It affects 26.x, 24.x and 22.x. The CNA scores it CVSS 3.0 7.5 with an availability-only impact.
• CVE-2026-56846: retained HTTP/2 header blocks escaped maxSessionMemory accounting, allowing remote memory exhaustion. It affects 24.x and 22.x and is scored 7.5.
• CVE-2026-58043: under --permission, path matching across radix-tree prefix boundaries could let code granted one path read or write outside the allowlist. It affects all lines and is scored 7.5, but requires local code execution.

The medium fixes cover HTTPS agent mTLS identity reuse across PFX certificates (CVE-2026-56850), and TLS session reuse that skipped hostname verification (CVE-2026-58040, an incomplete fix for CVE-2026-48934). They also cover node:sqlite iterator replay re-executing writes (CVE-2026-58041, 26.x and 24.x only), and process aborts from dns.resolveAny() responses with more than 256 A records (CVE-2026-58042) and from spoofed TypedArray lengths in sync zlib APIs (CVE-2026-58045). The low ones are two Permission Model write bypasses through trace events and process.report (CVE-2026-56847, CVE-2026-58039). The third is a header-truncation desync that can enable request smuggling in Node-based forwarding proxies (CVE-2026-58044).

Who is affected#

Node.js 26.x before 26.5.1, 24.x before 24.18.1 and 22.x before 22.23.2. The project says End-of-Life lines are always affected by a security release and get no fix. That includes 20.x and older.

Do you really need to act?#

Yes, but on a "this week" clock, not a "tonight" one. No exploitation was reported, and CISA's enrichment on the high-severity records lists exploitation as "none". The real risk depends on how you run Node:

• Public HTTP/2 servers in Node (http2.createSecureServer, or frameworks with HTTP/2 enabled): two remotely reachable memory bugs that CISA marks as automatable. An unauthenticated client can crash or exhaust the process. Prioritize these.
• HTTP/1.1 behind a proxy: the HTTP/2 bugs are not reachable. The remaining exposure is the TLS and DNS edge cases.
• Permission Model users: if you rely on --permission to contain untrusted code, three of these bugs let it write outside its allowlist. The Permission Model is not a full sandbox, so treat these fixes as required.
• Node-based reverse proxies that rebuild headers from req.headers: CVE-2026-58044 is low-rated but worth closing.

Node.js has shipped later security releases since July. Moving straight to the latest patch on your line covers this batch and the later ones.

What to do now#

1. Inventory: node -v in every image, VM and CI runner. In Kubernetes, kubectl exec <pod> -- node -v, or check image tags in your registry.
2. Upgrade to 26.5.1, 24.18.1, 22.23.2 or anything later on the same line: nvm install 24, volta install node@24, OS packages, or rebuilt node:* base images. Then restart processes.
3. Rebuild container images and single executable applications. Restarting an old image does not change the embedded runtime.
4. If an upgrade has to wait, turn off HTTP/2 on internet-facing Node listeners or terminate it at a proxy. Do not rely on --permission to contain untrusted code until you have patched.
5. Move workloads off End-of-Life lines.

How to tell if you were hit#

There are no published indicators of compromise and no reported attacks. Most of these bugs end in a crash or memory exhaustion rather than a quiet takeover. Look for Node.js HTTP/2 services with unexplained memory growth, OOM kills or segfaults under many concurrent streams or large header blocks. For CVE-2026-58043, review whether code running under --permission wrote files outside its granted paths.

Timeline#

• Jul 27, 2026 — The release planned for July 28 is postponed for more testing.
• Jul 28, 2026 — Postponed again because of infrastructure issues.
• Jul 29, 2026 — 26.5.1, 24.18.1 and 22.23.2 ship with 11 CVE fixes.
• Aug 4, 2026 — Records for the two HTTP/2 CVEs are published with CISA's enrichment (exploitation: none, automatable: yes).

Vulnerability records

• CVE-2026-56846 · A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.
• CVE-2026-56848 · A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in…
• CVE-2026-58043 · A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
• CVE-2026-56850 · A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across…
• CVE-2026-58040 · An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of…
• CVE-2026-58041 · A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared…
• CVE-2026-58042 · A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
• CVE-2026-58045 · A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process…
• CVE-2026-56847 · A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.
• CVE-2026-58039 · A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.
• CVE-2026-58044 · A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Node.js — Wednesday, July 29, 2026 Security Releases nodejs.org
2. Node.js — Node.js 24.18.1 (LTS) release notes nodejs.org
3. Node.js — Node.js 22.23.2 (LTS) release notes nodejs.org
4. CVE record — CVE-2026-56848 cve.org
5. CVE record — CVE-2026-56846 cve.org
6. CVE record — CVE-2026-58043 cve.org
7. CVE record — CVE-2026-58044 cve.org