Node.js shipped security releases on 11 November 2026: v22.23.5, v24.22.3, and v26.13.1. They fix 16 CVEs, seven rated High, nearly all in the HTTP/2, HTTPS, and TLS code. This is the second Node.js security release in three weeks, so servers that took the October Brotli fix still need this one. Upstream lists no workaround.
CloudLinux had fixed alt-nodejs packages out for every line it builds, end-of-life ones included, by 00:33 UTC on 12 November. If you host customer apps through Node.js Selector, update and restart them today.
The CVEs that matter
| CVE | Issue | Severity | Lines |
|---|---|---|---|
| CVE-2026-123864 | HTTPS zero-length TLS write leaks server heap into the request body | High | 22, 24, 26 |
| CVE-2026-123863 | HTTP/2 remote abort crashes the process | High | 24, 26 |
| CVE-2026-123865 | HTTP/2 sessions never cleaned up after a shutdown protocol error | High | 22, 24, 26 |
| CVE-2026-123866 | HTTP/2 stream teardown sends freed memory to the peer | High | 22, 24, 26 |
| CVE-2026-123874 | HTTP/2 use-after-free in respondWithFile() | High | 24, 26 |
| CVE-2026-126051 | Uncaught exception in TLS servers via deferred handshake callbacks | High | 24, 26 |
| CVE-2026-123872 | TLS 1.2 renegotiation bypasses client certificate authentication | High | 22, 24, 26 |
| CVE-2026-123828 | HTTP/2 heap overflow in session.altsvc() | Medium | 24, 26 |
| CVE-2026-123871 | Proxy credentials disclosed in error messages | Medium | 22, 24, 26 |
| CVE-2026-123877 | https.Agent certificate validation bypass via TLS session reuse | Medium | 22, 24, 26 |
The rest are two more Medium HTTP/2 and mTLS issues and three Low items covering zlib and the Permission Model. The releases also update llhttp on all three lines, undici on 24 and 26, and SQLite on 22 and 24.
CVE-2026-123864 is the headline. Under the right handler pattern, an unauthenticated client gets back chunks of server heap, which can include TLS private keys and other users' request data. Patching stops the leak but doesn't undo one. If an app terminated TLS in Node and was exposed, rotate its key.
Fixed CloudLinux packages
| Package | Fixed version | Systems |
|---|---|---|
| alt-nodejs26 | 26.13.1 | CloudLinux 8, 9 |
| alt-nodejs24 | 24.22.3 | CloudLinux 8, 9 |
| alt-nodejs22 | 22.23.5 | CloudLinux 8, 9 |
| alt-nodejs20 | 20.20.2-17 | CloudLinux 7, 8, 9 |
| alt-nodejs10, 12, 14, 16, 18 | Backported | CloudLinux 7, 8, 9 |
| alt-nodejs19 | Backported | CloudLinux 8, 9 |
| ea-nodejs22 | 22.23.5 | cPanel on CloudLinux 8 |
CloudLinux OS 10 pulls its alt-nodejs builds from the TuxCare repositories, which published EL10 packages the same evening.
Update and restart
rpm -qa 'alt-nodejs*' 'ea-nodejs*'
yum update 'alt-nodejs*' 'ea-nodejs*'
Running apps keep the old binary in memory. Find them, then restart from Setup Node.js App in cPanel or per app from the shell:
ps -eo pid,lstart,args | grep -E '[n]ode( |$)'
cloudlinux-selector restart --json --interpreter nodejs --user jdoe --app-root myapp
On 22, 24, and 26, node --version should report the fixed version. End-of-life lines keep their original upstream version string, so check the RPM release with rpm -q alt-nodejs20 instead. If you run Node.js through cPanel's Application Manager, see hosting Node.js apps on cPanel for where ea-nodejs22 fits.
What is CVE-2026-123864 in Node.js?+
Is there a workaround for the November 2026 Node.js vulnerabilities?+
Are end-of-life alt-nodejs versions patched on CloudLinux?+
Do I need to restart Node.js apps after updating alt-nodejs?+
Next steps
- Lock down the kernel side with KernelCare live patching on cPanel, so a reboot isn't the bottleneck for the next advisory.
- Check LiteSpeed is on 6.3.7 build 9 if it fronts your Node.js apps.
- Need Node.js Selector on more servers? Add a CloudLinux license.