# Node.js Patches 16 Flaws; 5 Found by a Researcher Working With Claude and Anthropic Research URL: https://edufabtech.com/news/nodejs-november-2026-security-release-ai-assisted-vulnerabilities Section: News · Technology Published: 2026-11-13 Publisher: EduFabTech (https://edufabtech.com) > Node.js shipped versions 22.23.5, 24.22.3 and 26.13.1 on November 11, 2026, fixing 16 CVEs, seven rated high, including a TLS key-leak flaw reported with help from Claude and Anthropic Research. The Node.js project released versions 22.23.5, 24.22.3 and 26.13.1 on Wednesday, November 11, 2026, fixing 16 vulnerabilities in the JavaScript runtime, seven of them rated high severity, according to the official Node.js security release. The most serious flaw, CVE-2026-123864, lets an unauthenticated client read memory from other connections on the same HTTPS server, including, in the project's own description, "TLS private keys and other users' requests." Five of the 16 reports, spanning HTTP/2, HTTPS and zlib, are credited to security researcher Chris Rohlf "in collaboration with Claude and Anthropic Research," per the same advisory. ## What the high-severity flaws do CVE-2026-123864 arises from a re-entrancy bug in HTTPS: a zero-length TLS write causes `TLSWrap::DoWrite()` to re-enter `llhttp_execute()`, producing a use-after-free and an out-of-bounds heap read that can expose another connection's data, per the Node.js advisory. A companion set of HTTP/2 bugs lets unauthenticated clients crash a default server (CVE-2026-123863), leak the contents of other connections' response buffers through a use-after-free during stream teardown (CVE-2026-123866), or leave sessions stuck in `CLOSE_WAIT` so that memory and file descriptors are never released (CVE-2026-123865), the advisory states. A sixth high-severity issue, CVE-2026-126051, is a deferred-callback use-after-destroy in TLS handshake handling that can crash servers using hooks such as `SNICallback` or `server.addContext()`. A seventh, CVE-2026-123872, lets a client switch its servername during TLS 1.2 renegotiation to bypass per-host client-certificate policy checks. Independent reporting from The Hacker News confirms the count of 16 CVEs, the seven high-severity ratings, and that the Node.js advisory records no known active exploitation of any of them. ![A severity ladder showing the 16 fixes split into High (7), Medium (6), and Low (3), with the most severe flaw, the TLS private-key leak CVE-2026-123864, called out at the top.](https://edufabtech.com/uploads/2026/11/nodejs-november-2026-security-release-ai-assisted-vulnerabilities-2.png) *A severity ladder showing the 16 fixes split into High (7), Medium (6), and Low (3), with the most severe flaw, the TLS private-key leak CVE-2026-123864, called out at the top. — EduFabTech · Own work* ## Six more medium and three low-severity fixes The release also closes six medium-severity issues, among them a one-byte heap buffer overflow in HTTP/2 Alt-Svc handling (CVE-2026-123828), a mutual-TLS bypass where a per-host client certificate authority is never installed when a hostname has no server certificate of its own (CVE-2026-123867), and a flaw letting HTTP/2 clients exhaust server memory because queued inbound data on undrained streams is not counted against `maxSessionMemory` (CVE-2026-123868), per the Node.js advisory. Three low-severity fixes include a Permission Model bypass in recursive `fs.watch()` that discloses file and directory names a process should not be able to read, reported by Trail of Bits working with OpenAI, and a wildcard over-grant in the Permission Model's `--allow-fs-read` and `--allow-fs-write` rules. ## Why the AI-research credit matters Node.js's advisory attributes CVE-2026-123863, CVE-2026-123864, CVE-2026-123874, CVE-2026-123875 and CVE-2026-123862 to Chris Rohlf "in collaboration with Claude and Anthropic Research." That is nearly a third of this release's 16 fixes, and one of them, CVE-2026-123863, lands in code the project had already tried to fix once: the advisory describes it as a variant of CVE-2024-27983, a previously patched HTTP/2 assertion bug whose 2024 fix did not cover this path. For students and researchers tracking how AI tools are being applied to security work, this release is a concrete data point: a named human researcher, using an AI lab's model and research team as a collaborator, produced reports that the Node.js core team accepted and fixed in a widely used runtime, rather than a vendor's self-reported benchmark result. ## What it means for developers running Node.js Node.js has not published a workaround for any of the 16 issues, so updating to 22.23.5, 24.22.3 or 26.13.1 is the only way to close them. Anyone running an HTTPS or HTTP/2 server on an affected line is exposed to the TLS key-leak and server-crash bugs regardless of application code, because the flaws sit in Node's built-in `http2`, `https` and `tls` modules rather than in a third-party dependency. Teams maintaining long-lived Node.js services, including those used in research computing and teaching environments, should treat the TLS and HTTP/2 fixes as mandatory rather than optional hardening. ![A three-step flow — researcher-plus-AI collaboration, five vulnerability reports across HTTP/2, HTTPS and zlib, and the November 11 patch — illustrating how the AI-assisted findings reached release.](https://edufabtech.com/uploads/2026/11/nodejs-november-2026-security-release-ai-assisted-vulnerabilities-3.png) *A three-step flow — researcher-plus-AI collaboration, five vulnerability reports across HTTP/2, HTTPS and zlib, and the November 11 patch — illustrating how the AI-assisted findings reached release. — EduFabTech · Own work* ## What is not yet independently verified The Node.js advisory does not publish a technical write-up of how Rohlf and Anthropic Research found each of the five AI-assisted reports, and no independent lab has yet published its own analysis of that discovery process. The claims available so far — the CVE descriptions, severity ratings and researcher credits — come from the Node.js project's own advisory and from The Hacker News's report on it; neither source details the specific prompts, tooling or review steps used in the AI-assisted reports. ## Sources 1. Node.js Project. (2026). Node.js — Wednesday, November 11, 2026 Security Releases. Node.js https://nodejs.org/en/blog/vulnerability/november-2026-security-releases 2. The Hacker News. (2026). Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data. The Hacker News https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html --- Source page: https://edufabtech.com/news/nodejs-november-2026-security-release-ai-assisted-vulnerabilities Quote with a link to the source page. © EduFabTech.