# Node.js July security release fixes high-severity HTTP/2 and Permission Model flaws Node.js 22, 24 and 26 received security updates on July 29 for three high-severity issues plus multiple medium and low flaws. The most broadly actionable fixes cover HTTP/2 memory safety and Permission Model filesystem boundaries. Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access. - Status: Active - Published: 2026-08-22T15:25:41+12:00 - Updated: 2026-08-22T15:25:41+12:00 - Categories: Web Development, JavaScript, Developer Tools - Tags: HTTP/2, Node.js, Permission Model, security - Canonical HTML: https://beyondthe.news/dossiers/nodejs-july-2026-security-http2-permission-model-cves ## What changed The Node.js project released security updates for the active 22.x, 24.x and 26.x lines on July 29, 2026. The release fixes three high-severity vulnerabilities: an HTTP/2 retained-header path that can bypass session-memory limits and exhaust memory, an HTTP/2 re-entrant send bug that can trigger a heap use-after-free, and a Permission Model radix-tree matching bug that can grant filesystem access outside an intended allowlist. The same release also fixes medium-severity HTTPS Agent identity/session reuse, SQLite iterator replay, DNS and zlib denial-of-service issues, plus low-severity Permission Model and HTTP request-smuggling flaws. Fixed versions are v22.23.2, v24.18.1 and v26.5.1. ## Why it matters This is a runtime patch rather than an application-library update, so vulnerable behavior can sit underneath otherwise fully patched dependency graphs. Internet-facing Node HTTP/2 servers have denial-of-service and memory-safety exposure, while applications relying on `--permission` as a sandbox boundary can grant broader filesystem access than their configuration suggests. The practical action is straightforward: move active production lines to the patched runtime releases and rebuild deployment images, not merely run a package-manager audit. ## Two high-severity fixes sit in the HTTP/2 stack CVE-2026-56846 allows retained HTTP/2 header blocks to escape the intended `maxSessionMemory` accounting and drive remote memory exhaustion. Node’s bulletin lists active 24.x and 22.x as affected by this issue. CVE-2026-56848 is a separate re-entrancy bug where an HTTP/2 send can occur while receive processing is active, producing a heap use-after-free; Node lists 26.x, 24.x and 22.x as affected. ## The Permission Model had an allowlist-boundary failure CVE-2026-58043 affects Node’s `--permission` filesystem enforcement. A radix-tree prefix-boundary error can let code granted access to one path read or write outside the intended allowlist. That makes the patch particularly important for workloads treating Node’s Permission Model as a containment layer for plugins, user code or partially trusted automation. ## HTTPS Agent reuse also received two fixes CVE-2026-56850 fixes connection reuse that could cross PFX client-certificate identities in mTLS scenarios. CVE-2026-58040 fixes TLS session reuse that could skip hostname verification across identity policies. These are narrower than the headline HTTP/2 issues but matter for services making outbound HTTPS calls with multiple client identities or policy domains through shared Agents. ## Several availability and integrity bugs were fixed in core modules The release also addresses a `node:sqlite` SQLTagStore iterator path that can replay writes, a `dns.resolveAny()` abort on responses with many A records, and a zlib synchronous-API crash reachable through a spoofed TypedArray length. Low-severity fixes close two additional Permission Model write paths and an HTTP parser/header truncation condition that can enable request smuggling in certain Node-based forwarding proxies. ## Patch the runtime artifact, not just npm dependencies The fixed releases are Node v22.23.2, v24.18.1 and v26.5.1. Teams using containers, serverless base images, buildpacks or managed runtimes should verify the actual Node binary in the deployed artifact after rebuilding. A clean `npm audit` does not demonstrate that these runtime CVEs are fixed. ## Key details - Node.js security releases shipped July 29, 2026 for active 22.x, 24.x and 26.x lines. - Fixed versions are Node.js v22.23.2, v24.18.1 and v26.5.1. - CVE-2026-56848 is a high-severity HTTP/2 heap-use-after-free affecting 22.x, 24.x and 26.x. - CVE-2026-58043 is a high-severity Permission Model flaw that can over-grant filesystem access across allowlist boundaries. - CVE-2026-56846 is a high-severity HTTP/2 memory-exhaustion issue; Node’s bulletin specifically lists active 22.x and 24.x as affected. - The release also fixes HTTPS Agent identity/session reuse, SQLite write replay, DNS/zlib DoS and lower-severity Permission Model/request-smuggling issues. ## Builder takeaways - Upgrade active production runtimes to at least 22.23.2, 24.18.1 or 26.5.1 and rebuild images or deployment artifacts that embed Node. - If you expose Node’s HTTP/2 server directly, prioritize the update even when application dependencies are unchanged; two headline flaws are in the runtime’s HTTP/2 implementation. - If you rely on `--permission`, do not treat filesystem allowlists on older runtimes as a strong boundary. Patch first, then rerun tests that attempt neighboring-prefix and out-of-allowlist reads/writes. - Audit shared HTTPS Agents in systems that use multiple PFX client certificates or distinct hostname policies; the July release fixes identity/session reuse behavior as well as server-side issues. - Verify the deployed binary with `node --version` after rollout. Package-manager vulnerability scans alone will not catch an unpatched Node executable. - Move off end-of-life Node lines rather than waiting for equivalent fixes; the project warns that EOL versions are considered affected when security releases occur. ## What to watch - Follow-up advisories or exploit reports for the HTTP/2 use-after-free and memory-exhaustion issues. - Whether hosting and serverless platforms publish their own rollout timelines for patched Node runtimes. - Additional Permission Model hardening as Node’s sandboxing surface matures. - Any clarification from Node on why CVE-2026-56846’s impact list names 22.x and 24.x while the security train also covers 26.x. ## Uncertainties - The Node advisory does not report active exploitation for these vulnerabilities. - CVE-2026-56846’s published impact section specifically lists active 24.x and 22.x, unlike the other major fixes that explicitly include 26.x; builders should follow the project’s own affected-version guidance rather than infer 26.x exposure. - Severity does not imply equal exploitability in every deployment; some flaws require HTTP/2, Permission Model, mTLS or other specific runtime features. ## Sources - [Wednesday, July 29, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases) — Node.js Project · official security advisory · 2026-07-29T00:00:00+12:00. Primary advisory for all CVEs, affected active release lines and fixed release versions. - [Node.js v22.23.2 release](https://nodejs.org/en/blog/release/v22.23.2) — Node.js Project · official release · 2026-07-29T00:00:00+12:00. Release-level confirmation of the security fixes for the Node 22 line.