tlder@devNode.js security fixes go live: 26.5.1, 24.18.1, 22.23.2 with three High CVEs
tlder@dev:~$
Backend/Node.js

Node.js security fixes go live: 26.5.1, 24.18.1, 22.23.2 with three High CVEs

  • Shipped
  • Action required
  • High importance

Yesterday's placeholder is now a real changelog. The Node.js security releases — delayed a day by infrastructure trouble — landed as v26.5.1, v24.18.1, and v22.23.2, and the withheld CVE details are public. Eleven CVEs in total, three rated High: an HTTP/2 flaw where retained headers slip past the maxSessionMemory limit and exhaust memory (CVE-2026-56846), a re-entrant HTTP/2 send that triggers a heap use-after-free (CVE-2026-56848), and a Permission Model path-matching bug that over-grants filesystem access across radix-tree boundaries (CVE-2026-58043). The rest are mediums and lows across the HTTPS Agent, node:sqlite, dns.resolveAny(), and node:zlib, plus bundled undici and llhttp bumps. If you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox, treat this as the upgrade to do today — the two HTTP/2 issues are the ones that bite in production.