Node.js Patches 11 Flaws Across Active Release Lines

Node.js released security updates for all active release lines, shipping v22.23.2, v24.18.1, and v26.5.1 to fix 11 vulnerabilities affecting the 22.x, 24.x, and 26.x branches. The most serious issues include two high-severity HTTP/2 flaws, CVE-2026-56846 and CVE-2026-56848, which could let attackers trigger denial of service through memory exhaustion or process crashes, and CVE-2026-58043, a high-severity bypass in the Permission Model that could allow applications started with --permission to access filesystem paths outside the intended allowlist.

The update also addresses weaknesses involving HTTPS connection reuse, mTLS identity reuse, hostname verification bypass, DNS handling, SQLite, zlib APIs, and an HTTP parser issue that could enable request smuggling in Node.js-based forwarding proxies. An oss-sec follow-up noted that an earlier announcement linked to the wrong Node.js blog entry and should instead reference the July security releases page, while maintainers emphasized that unsupported Node.js versions remain exposed and should be retired or upgraded immediately.