--- title: "Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs" url: https://erroneo.us/security/briefs/nodejs-july-2026-security-releases/ description: "Node.js 26.5.1, 24.18.1 and 22.23.2 fix 11 CVEs, incl. remotely triggerable HTTP/2 memory bugs and a Permission Model bypass. Not exploited. Patch this week." type: security-brief section: "Security Digest" date_published: 2026-07-29 date_modified: 2026-08-04 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Patch this week" cves: ["CVE-2026-56846", "CVE-2026-56848", "CVE-2026-58043", "CVE-2026-56850", "CVE-2026-58040", "CVE-2026-58041", "CVE-2026-58042", "CVE-2026-58045", "CVE-2026-56847", "CVE-2026-58039", "CVE-2026-58044"] severity: "high" exploited: "none-known" kev: false license: All rights reserved. Quote with attribution and a link. --- # Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs **Verdict: Patch this week.** Routine but real: upgrade every supported Node.js line this week, sooner if you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox. - **Who must act:** Anyone running Node.js 22.x, 24.x or 26.x, most urgently services that accept HTTP/2 connections directly from untrusted clients or run code under --permission. - **Who can relax:** Services that only speak HTTP/1.1 behind a proxy and do not use --permission, node:sqlite or mTLS agents can roll the upgrade into their normal cycle. - **Affected:** Node.js 26.x before 26.5.1; Node.js 24.x before 24.18.1; Node.js 22.x before 22.23.2; All End-of-Life Node.js lines (per the Node.js project) - **Fixed:** Node.js 26.5.1 (Current); Node.js 24.18.1 (LTS); Node.js 22.23.2 (LTS); Later releases, including the October 2026 security releases - **CVEs:** CVE-2026-56846, CVE-2026-56848, CVE-2026-58043, CVE-2026-56850, CVE-2026-58040, CVE-2026-58041, CVE-2026-58042, CVE-2026-58045, CVE-2026-56847, CVE-2026-58039, CVE-2026-58044 - **CISA KEV:** no · **Exploitation:** No known exploitation ## What to do 1. Run node -v on every host, container and CI image that serves traffic. 2. Upgrade to 26.5.1, 24.18.1 or 22.23.2 or later (nvm install 24.18.1, your OS packages, or refreshed node:* images), then restart processes. 3. Rebuild and redeploy container images and single executable applications so they embed the fixed runtime. 4. If you cannot upgrade yet and do not need HTTP/2, disable it on public listeners or terminate HTTP/2 at a proxy. 5. Move anything on an End-of-Life Node.js line to a supported LTS. ### How to check if you are affected - Compare node -v (or process.version in logs) against the fixed versions; anything lower is affected. - Watch for Node.js HTTP/2 servers with unexplained memory growth or crashes under many concurrent streams or large header blocks. - No exploitation has been reported; CISA's enrichment lists exploitation as none for the high-severity CVEs. ## What happened On July 29, 2026, the Node.js project shipped [security releases](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases) for all three supported lines: 26.5.1 (Current), 24.18.1 (LTS) and 22.23.2 (LTS). The releases fix 11 CVEs: three high, five medium and three low. They also update llhttp to 9.4.3 and update undici. The [24.18.1 notes](https://nodejs.org/en/blog/release/v24.18.1) list undici 7.29.0, and the [22.23.2 notes](https://nodejs.org/en/blog/release/v22.23.2) list 6.28.0. The release had been planned for July 28 and was postponed twice, first for more testing and then for infrastructure problems. The three high-severity fixes: - **[CVE-2026-56848](https://www.cve.org/CVERecord?id=CVE-2026-56848)**: in HTTP/2 handling, `nghttp2_session_mem_send()` could be called re-entrantly while `nghttp2_session_mem_recv()` was running, causing a heap use-after-free. It affects 26.x, 24.x and 22.x. The CNA scores it CVSS 3.0 7.5 with an availability-only impact. - **[CVE-2026-56846](https://www.cve.org/CVERecord?id=CVE-2026-56846)**: retained HTTP/2 header blocks escaped `maxSessionMemory` accounting, allowing remote memory exhaustion. It affects 24.x and 22.x and is scored 7.5. - **[CVE-2026-58043](https://www.cve.org/CVERecord?id=CVE-2026-58043)**: under `--permission`, path matching across radix-tree prefix boundaries could let code granted one path read or write outside the allowlist. It affects all lines and is scored 7.5, but requires local code execution. The medium fixes cover HTTPS agent mTLS identity reuse across PFX certificates (CVE-2026-56850), and TLS session reuse that skipped hostname verification (CVE-2026-58040, an incomplete fix for CVE-2026-48934). They also cover `node:sqlite` iterator replay re-executing writes (CVE-2026-58041, 26.x and 24.x only), and process aborts from `dns.resolveAny()` responses with more than 256 A records (CVE-2026-58042) and from spoofed TypedArray lengths in sync zlib APIs (CVE-2026-58045). The low ones are two Permission Model write bypasses through trace events and `process.report` (CVE-2026-56847, CVE-2026-58039). The third is a header-truncation desync that can enable request smuggling in Node-based forwarding proxies ([CVE-2026-58044](https://www.cve.org/CVERecord?id=CVE-2026-58044)). ## Who is affected Node.js 26.x before 26.5.1, 24.x before 24.18.1 and 22.x before 22.23.2. The project says End-of-Life lines are always affected by a security release and get no fix. That includes 20.x and older. ## Do you really need to act? Yes, but on a "this week" clock, not a "tonight" one. No exploitation was reported, and CISA's enrichment on the high-severity records lists exploitation as "none". The real risk depends on how you run Node: - **Public HTTP/2 servers in Node** (`http2.createSecureServer`, or frameworks with HTTP/2 enabled): two remotely reachable memory bugs that CISA marks as automatable. An unauthenticated client can crash or exhaust the process. Prioritize these. - **HTTP/1.1 behind a proxy:** the HTTP/2 bugs are not reachable. The remaining exposure is the TLS and DNS edge cases. - **Permission Model users:** if you rely on `--permission` to contain untrusted code, three of these bugs let it write outside its allowlist. The Permission Model is not a full sandbox, so treat these fixes as required. - **Node-based reverse proxies** that rebuild headers from `req.headers`: CVE-2026-58044 is low-rated but worth closing. Node.js has shipped later security releases since July. Moving straight to the latest patch on your line covers this batch and the later ones. ## What to do now 1. Inventory: `node -v` in every image, VM and CI runner. In Kubernetes, `kubectl exec -- node -v`, or check image tags in your registry. 2. Upgrade to 26.5.1, 24.18.1, 22.23.2 or anything later on the same line: `nvm install 24`, `volta install node@24`, OS packages, or rebuilt `node:*` base images. Then restart processes. 3. Rebuild container images and single executable applications. Restarting an old image does not change the embedded runtime. 4. If an upgrade has to wait, turn off HTTP/2 on internet-facing Node listeners or terminate it at a proxy. Do not rely on `--permission` to contain untrusted code until you have patched. 5. Move workloads off End-of-Life lines. ## How to tell if you were hit There are no published indicators of compromise and no reported attacks. Most of these bugs end in a crash or memory exhaustion rather than a quiet takeover. Look for Node.js HTTP/2 services with unexplained memory growth, OOM kills or segfaults under many concurrent streams or large header blocks. For CVE-2026-58043, review whether code running under `--permission` wrote files outside its granted paths. ## Timeline - Jul 27, 2026 — The release planned for July 28 is postponed for more testing. - Jul 28, 2026 — Postponed again because of infrastructure issues. - Jul 29, 2026 — 26.5.1, 24.18.1 and 22.23.2 ship with 11 CVE fixes. - Aug 4, 2026 — Records for the two HTTP/2 CVEs are published with CISA's enrichment (exploitation: none, automatable: yes). ## Sources 1. [Node.js — Wednesday, July 29, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases) 2. [Node.js — Node.js 24.18.1 (LTS) release notes](https://nodejs.org/en/blog/release/v24.18.1) 3. [Node.js — Node.js 22.23.2 (LTS) release notes](https://nodejs.org/en/blog/release/v22.23.2) 4. [CVE record — CVE-2026-56848](https://www.cve.org/CVERecord?id=CVE-2026-56848) 5. [CVE record — CVE-2026-56846](https://www.cve.org/CVERecord?id=CVE-2026-56846) 6. [CVE record — CVE-2026-58043](https://www.cve.org/CVERecord?id=CVE-2026-58043) 7. [CVE record — CVE-2026-58044](https://www.cve.org/CVERecord?id=CVE-2026-58044) --- Source page: https://erroneo.us/security/briefs/nodejs-july-2026-security-releases/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt