Node.js July 2026 Security Release: 11 Vulnerabilities Fixed Across All Active Lines
The Node.js July 2026 security release addresses 11 vulnerabilities across all three active release lines: 22.x (LTS), 24.x (Current), and 26.x (Current). The updates — v22.23.2, v24.18.1, and v26.5.1 — were published on July 30, 2026 and include fixes for high-severity HTTP/2 memory issues, filesystem permission bypasses, and multiple denial-of-service vectors.
Vulnerability Summary
| CVE | Severity | Component | Impact |
|---|---|---|---|
| CVE-2026-56846 | High | HTTP/2 | Memory limit bypass via retained header blocks |
| CVE-2026-56848 | High | HTTP/2 | Heap use-after-free in nghttp2 processing |
| CVE-2026-58043 | High | Permission Model | Filesystem allowlist bypass via radix-tree flaw |
| CVE-2026-56850 | Medium | HTTPS/mTLS | Identity reuse across different PFX certificates |
| CVE-2026-58040 | Medium | TLS | Hostname verification bypass via session reuse |
| CVE-2026-58041 | Medium | SQLite | Write re-execution vulnerability |
| CVE-2026-58042 | Medium | DNS | Crash on oversized responses (>256 A records) |
| CVE-2026-58045 | Medium | Zlib | Crash via spoofed TypedArray byte length |
| CVE-2026-56847 | Medium | Trace Events | Allowlist bypass |
| CVE-2026-58039 | Medium | Process Report | Allowlist bypass |
| CVE-2026-58044 | Medium | HTTP | Request smuggling via header truncation |
Updated Dependencies: Undici (8.9.0 / 7.29.0 / 6.28.0), llhttp (9.4.3)
High-Severity Vulnerabilities Deep Dive
CVE-2026-56846: HTTP/2 Memory Limit Bypass
Retained HTTP/2 header blocks can bypass the configured maxSessionMemory limit. An attacker sending specially crafted HTTP/2 traffic can consume unbounded server memory, leading to denial-of-service. This affects all active release lines (22.x, 24.x, 26.x).
CVE-2026-56848: HTTP/2 Heap Use-After-Free
A heap use-after-free occurs when the underlying nghttp2 library processes data while simultaneously receiving additional data. Memory safety issues of this class can crash the Node.js process and may have broader security implications depending on runtime conditions. This is the second high-severity HTTP/2 flaw in this release.
CVE-2026-58043: Permission Model Filesystem Bypass
Applications launched with the --permission flag (experimental Node.js Permission Model) could mistakenly grant filesystem access outside the intended allowlist. The flaw lies in radix-tree prefix boundary handling — a user with access to an approved path could potentially read or write files in unintended locations. This undermines the security boundary the Permission Model is designed to enforce.
Medium-Severity Vulnerabilities
CVE-2026-56850 (mTLS Identity Reuse): HTTPS Agents could reuse mutual TLS identities across requests with different PFX certificates, potentially causing cross-contamination of client identities in multi-tenant environments.
CVE-2026-58040 (Hostname Verification Bypass): An incomplete earlier patch allowed TLS session reuse to bypass hostname verification across different identity policies.
CVE-2026-58042 (DNS Crash): dns.resolveAny() aborts when the response contains more than 256 A records, enabling DoS via crafted DNS responses.
CVE-2026-58045 (Zlib Crash): Synchronous node:zlib APIs can crash when processing a spoofed TypedArray byte length.
CVE-2026-58044 (HTTP Request Smuggling): HTTP header truncation could enable request smuggling in Node.js-based forwarding proxies.
CVE-2026-56847 / CVE-2026-58039 (Permission Model Bypasses): Additional lower-severity bypasses in trace-event logs and process reports that could allow writing files outside paths authorized by --allow-fs-write.
Affected Versions & Patched Versions
| Release Line | Previous Version | Patched Version | Status |
|---|---|---|---|
| 22.x (LTS) | 22.23.1 | 22.23.2 | Active LTS |
| 24.x (Current) | 24.18.0 | 24.18.1 | Current |
| 26.x (Current) | 26.5.0 | 26.5.1 | Current |
Mitigation & Upgrade Instructions
Immediate Upgrade (Required)
Using nvm (recommended):
Using package managers:
Docker:
Post-Upgrade Verification
Verify the installed version:
Test that your application starts and functions correctly. Pay special attention to:
- HTTP/2 server endpoints (load test for memory stability)
- Applications using
--permissionflag (verify filesystem boundaries) - HTTPS/mTLS client code (verify certificate handling)
- DNS-heavy applications (test with large responses)
Deprecation Notice: Retire Unsupported Versions
Node.js versions prior to 22.x (including 18.x, 20.x) are no longer receiving security updates. These versions remain vulnerable to all 11 flaws disclosed in this release. Migrate immediately:
| Version | Status | Action |
|---|---|---|
| 18.x | End-of-Life (Apr 2025) | Migrate to 22.x LTS |
| 20.x | End-of-Life (Oct 2025) | Migrate to 22.x LTS |
| 21.x | End-of-Life (Jun 2025) | Migrate to 22.x or 26.x |
| 23.x | End-of-Life (Jun 2025) | Migrate to 24.x or 26.x |
Detection & Monitoring
Monitor for exploitation attempts:
- HTTP/2 memory spikes: Alert on
maxSessionMemoryapproaching limits - Permission Model anomalies: Log filesystem access outside allowlists
- Crash loops: Watch for repeated worker crashes (DNS, Zlib, HTTP parser)
- mTLS certificate mismatches: Audit certificate reuse across connections
Frequently Asked Questions
Do I need to upgrade if I don't use HTTP/2?
Yes. While CVE-2026-56846 and CVE-2026-56848 are HTTP/2-specific, the release includes 9 other vulnerabilities affecting DNS, TLS, Permission Model, Zlib, SQLite, and HTTP parsing that may apply to your application.
Is the Permission Model (--permission) stable?
No. The Permission Model is still experimental and not recommended for production use. However, if you are experimenting with it, CVE-2026-58043 is a significant bypass that undermines its security guarantees. Upgrade to get the fix.
What about Undici and llhttp updates?
The bundled Undici (Node.js HTTP client) and llhttp (HTTP parser) updates address additional vulnerabilities in those dependencies. They are included automatically in the Node.js release — no separate action needed.
Can I just patch the specific vulnerability?
No. Node.js does not provide backports for individual CVEs. You must upgrade the entire runtime to a patched version.
How do I know if I was exploited?
Check logs for:
- Unexplained memory growth in HTTP/2 servers
- Filesystem access violations in Permission Model apps
- Repeated crashes with DNS/Zlib/HTTP parser stack traces
- Unexpected mTLS certificate presentations
Key Takeaways
- 11 vulnerabilities fixed across Node.js 22.x, 24.x, 26.x — upgrade immediately
- Two high-severity HTTP/2 flaws (memory bypass + use-after-free) enable DoS
- Permission Model bypass (CVE-2026-58043) breaks filesystem isolation
- Multiple DoS vectors in DNS, Zlib, HTTP parser, SQLite
- Unsupported versions (18.x, 20.x, 21.x, 23.x) are permanently vulnerable — migrate now
- Undici and llhttp updated as transitive dependencies
Conclusion
The Node.js July 2026 security release is significant — two high-severity HTTP/2 vulnerabilities alone warrant immediate attention for any production HTTP/2 service. Combined with the Permission Model bypass and multiple DoS vectors, this is a must-patch release. Organizations still on Node.js 18.x or 20.x should treat this as a forcing function to complete their LTS migration to 22.x.
Sources: Node.js Official Blog, CyberSecurityNews, Node.js GitHub Releases
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.