Node.js Patches 16 Flaws; 5 Found by a Researcher Working With Claude and Anthropic Research

The Node.js project released versions 22.23.5, 24.22.3 and 26.13.1 on Wednesday, November 11, 2026, fixing 16 vulnerabilities in the JavaScript runtime, seven of them rated high severity, according to the official Node.js security release. The most serious flaw, CVE-2026-123864, lets an unauthenticated client read memory from other connections on the same HTTPS server, including, in the project's own description, "TLS private keys and other users' requests." Five of the 16 reports, spanning HTTP/2, HTTPS and zlib, are credited to security researcher Chris Rohlf "in collaboration with Claude and Anthropic Research," per the same advisory.

What the high-severity flaws do

CVE-2026-123864 arises from a re-entrancy bug in HTTPS: a zero-length TLS write causes TLSWrap::DoWrite() to re-enter llhttp_execute(), producing a use-after-free and an out-of-bounds heap read that can expose another connection's data, per the Node.js advisory. A companion set of HTTP/2 bugs lets unauthenticated clients crash a default server (CVE-2026-123863), leak the contents of other connections' response buffers through a use-after-free during stream teardown (CVE-2026-123866), or leave sessions stuck in CLOSE_WAIT so that memory and file descriptors are never released (CVE-2026-123865), the advisory states. A sixth high-severity issue, CVE-2026-126051, is a deferred-callback use-after-destroy in TLS handshake handling that can crash servers using hooks such as SNICallback or server.addContext(). A seventh, CVE-2026-123872, lets a client switch its servername during TLS 1.2 renegotiation to bypass per-host client-certificate policy checks. Independent reporting from The Hacker News confirms the count of 16 CVEs, the seven high-severity ratings, and that the Node.js advisory records no known active exploitation of any of them.

Six more medium and three low-severity fixes

The release also closes six medium-severity issues, among them a one-byte heap buffer overflow in HTTP/2 Alt-Svc handling (CVE-2026-123828), a mutual-TLS bypass where a per-host client certificate authority is never installed when a hostname has no server certificate of its own (CVE-2026-123867), and a flaw letting HTTP/2 clients exhaust server memory because queued inbound data on undrained streams is not counted against maxSessionMemory (CVE-2026-123868), per the Node.js advisory. Three low-severity fixes include a Permission Model bypass in recursive fs.watch() that discloses file and directory names a process should not be able to read, reported by Trail of Bits working with OpenAI, and a wildcard over-grant in the Permission Model's --allow-fs-read and --allow-fs-write rules.

Why the AI-research credit matters

Node.js's advisory attributes CVE-2026-123863, CVE-2026-123864, CVE-2026-123874, CVE-2026-123875 and CVE-2026-123862 to Chris Rohlf "in collaboration with Claude and Anthropic Research." That is nearly a third of this release's 16 fixes, and one of them, CVE-2026-123863, lands in code the project had already tried to fix once: the advisory describes it as a variant of CVE-2024-27983, a previously patched HTTP/2 assertion bug whose 2024 fix did not cover this path. For students and researchers tracking how AI tools are being applied to security work, this release is a concrete data point: a named human researcher, using an AI lab's model and research team as a collaborator, produced reports that the Node.js core team accepted and fixed in a widely used runtime, rather than a vendor's self-reported benchmark result.

What it means for developers running Node.js

Node.js has not published a workaround for any of the 16 issues, so updating to 22.23.5, 24.22.3 or 26.13.1 is the only way to close them. Anyone running an HTTPS or HTTP/2 server on an affected line is exposed to the TLS key-leak and server-crash bugs regardless of application code, because the flaws sit in Node's built-in http2, https and tls modules rather than in a third-party dependency. Teams maintaining long-lived Node.js services, including those used in research computing and teaching environments, should treat the TLS and HTTP/2 fixes as mandatory rather than optional hardening.

What is not yet independently verified

The Node.js advisory does not publish a technical write-up of how Rohlf and Anthropic Research found each of the five AI-assisted reports, and no independent lab has yet published its own analysis of that discovery process. The claims available so far — the CVE descriptions, severity ratings and researcher credits — come from the Node.js project's own advisory and from The Hacker News's report on it; neither source details the specific prompts, tooling or review steps used in the AI-assisted reports.