Beyond the News
Sign in
Web DevelopmentJavaScriptDeveloper Tools Active dossier

Node.js July security release fixes high-severity HTTP/2 and Permission Model flaws

Node.js 22, 24 and 26 received security updates on July 29 for three high-severity issues plus multiple medium and low flaws. The most broadly actionable fixes cover HTTP/2 memory safety and Permission Model filesystem boundaries.

Reviewed and published by Lars Jansen Updated 5 min read
First published

Key details

  1. Node.js security releases shipped July 29, 2026 for active 22.x, 24.x and 26.x lines.
  2. Fixed versions are Node.js v22.23.2, v24.18.1 and v26.5.1.
  3. CVE-2026-56848 is a high-severity HTTP/2 heap-use-after-free affecting 22.x, 24.x and 26.x.
  4. CVE-2026-58043 is a high-severity Permission Model flaw that can over-grant filesystem access across allowlist boundaries.
  5. CVE-2026-56846 is a high-severity HTTP/2 memory-exhaustion issue; Node’s bulletin specifically lists active 22.x and 24.x as affected.
  6. The release also fixes HTTPS Agent identity/session reuse, SQLite write replay, DNS/zlib DoS and lower-severity Permission Model/request-smuggling issues.

What builders should take away

  1. Upgrade active production runtimes to at least 22.23.2, 24.18.1 or 26.5.1 and rebuild images or deployment artifacts that embed Node.
  2. If you expose Node’s HTTP/2 server directly, prioritize the update even when application dependencies are unchanged; two headline flaws are in the runtime’s HTTP/2 implementation.
  3. If you rely on `--permission`, do not treat filesystem allowlists on older runtimes as a strong boundary. Patch first, then rerun tests that attempt neighboring-prefix and out-of-allowlist reads/writes.
  4. Audit shared HTTPS Agents in systems that use multiple PFX client certificates or distinct hostname policies; the July release fixes identity/session reuse behavior as well as server-side issues.
  5. Verify the deployed binary with `node --version` after rollout. Package-manager vulnerability scans alone will not catch an unpatched Node executable.
  6. Move off end-of-life Node lines rather than waiting for equivalent fixes; the project warns that EOL versions are considered affected when security releases occur.

What changed

The Node.js project released security updates for the active 22.x, 24.x and 26.x lines on July 29, 2026. The release fixes three high-severity vulnerabilities: an HTTP/2 retained-header path that can bypass session-memory limits and exhaust memory, an HTTP/2 re-entrant send bug that can trigger a heap use-after-free, and a Permission Model radix-tree matching bug that can grant filesystem access outside an intended allowlist. The same release also fixes medium-severity HTTPS Agent identity/session reuse, SQLite iterator replay, DNS and zlib denial-of-service issues, plus low-severity Permission Model and HTTP request-smuggling flaws. Fixed versions are v22.23.2, v24.18.1 and v26.5.1.

Why it matters

This is a runtime patch rather than an application-library update, so vulnerable behavior can sit underneath otherwise fully patched dependency graphs. Internet-facing Node HTTP/2 servers have denial-of-service and memory-safety exposure, while applications relying on `--permission` as a sandbox boundary can grant broader filesystem access than their configuration suggests. The practical action is straightforward: move active production lines to the patched runtime releases and rebuild deployment images, not merely run a package-manager audit.

Two high-severity fixes sit in the HTTP/2 stack

CVE-2026-56846 allows retained HTTP/2 header blocks to escape the intended `maxSessionMemory` accounting and drive remote memory exhaustion. Node’s bulletin lists active 24.x and 22.x as affected by this issue. CVE-2026-56848 is a separate re-entrancy bug where an HTTP/2 send can occur while receive processing is active, producing a heap use-after-free; Node lists 26.x, 24.x and 22.x as affected.

The Permission Model had an allowlist-boundary failure

CVE-2026-58043 affects Node’s `--permission` filesystem enforcement. A radix-tree prefix-boundary error can let code granted access to one path read or write outside the intended allowlist. That makes the patch particularly important for workloads treating Node’s Permission Model as a containment layer for plugins, user code or partially trusted automation.

HTTPS Agent reuse also received two fixes

CVE-2026-56850 fixes connection reuse that could cross PFX client-certificate identities in mTLS scenarios. CVE-2026-58040 fixes TLS session reuse that could skip hostname verification across identity policies. These are narrower than the headline HTTP/2 issues but matter for services making outbound HTTPS calls with multiple client identities or policy domains through shared Agents.

Several availability and integrity bugs were fixed in core modules

The release also addresses a `node:sqlite` SQLTagStore iterator path that can replay writes, a `dns.resolveAny()` abort on responses with many A records, and a zlib synchronous-API crash reachable through a spoofed TypedArray length. Low-severity fixes close two additional Permission Model write paths and an HTTP parser/header truncation condition that can enable request smuggling in certain Node-based forwarding proxies.

Patch the runtime artifact, not just npm dependencies

The fixed releases are Node v22.23.2, v24.18.1 and v26.5.1. Teams using containers, serverless base images, buildpacks or managed runtimes should verify the actual Node binary in the deployed artifact after rebuilding. A clean `npm audit` does not demonstrate that these runtime CVEs are fixed.

What to watch next

  • Follow-up advisories or exploit reports for the HTTP/2 use-after-free and memory-exhaustion issues.
  • Whether hosting and serverless platforms publish their own rollout timelines for patched Node runtimes.
  • Additional Permission Model hardening as Node’s sandboxing surface matures.
  • Any clarification from Node on why CVE-2026-56846’s impact list names 22.x and 24.x while the security train also covers 26.x.

Still unclear

  • The Node advisory does not report active exploitation for these vulnerabilities.
  • CVE-2026-56846’s published impact section specifically lists active 24.x and 22.x, unlike the other major fixes that explicitly include 26.x; builders should follow the project’s own affected-version guidance rather than infer 26.x exposure.
  • Severity does not imply equal exploitability in every deployment; some flaws require HTTP/2, Permission Model, mTLS or other specific runtime features.

Sources

Direct reading behind this dossier.

2 sources
Node.js v22.23.2 release
Node.js Project official release

Release-level confirmation of the security fixes for the Node 22 line.

Continue reading
Web Development

Bun 1.4 rewrites the runtime in Rust and moves closer to Node.js 26 compatibility

Bun 1.4 combines an implementation-language rewrite with a larger built-in standard library and a substantial Node-compatibility push. For teams already running Bun, the practical task is to validate native addons, runtime behavior and workload-specific performance rather than treating this as a drop-in minor upgrade.

Web Development

Supabase fixes broken client trace propagation and links frontend traces to backend logs

The new tracing path gives Supabase requests a shared trace_id across browser or app spans and backend logs, with support for OpenTelemetry-compatible tooling. For JavaScript users, the practical detail is a required upgrade to supabase-js 2.112.0 or later because 2.106.0 through 2.111.x silently failed to propagate headers in bundled applications.

Web Development

npm v12 makes dependency install scripts opt-in by default

npm v12 disables dependency lifecycle scripts, Git dependencies and remote-URL dependencies by default unless projects explicitly allow them; sensitive npm account and package changes can no longer use bypass-2FA granular access tokens.