{"id":"VND-nodejs-july-2026-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2026-48934","CVE-2026-56846","CVE-2026-56847","CVE-2026-56848","CVE-2026-56850","CVE-2026-58039","CVE-2026-58040","CVE-2026-58041","CVE-2026-58042","CVE-2026-58043","CVE-2026-58044","CVE-2026-58045"],"title":"Node.js: Wednesday, July 29, 2026 Security Releases","description":"Security releases available\nUpdates are now available for the 26.x, 24.x, 22.x Node.js release lines for the\nfollowing issues.\nThis security release includes the following dependency updates to address public vulnerabilities:\nundici (8.9.0, 7.29.0, 6.28.0) on 26.x, 24.x, 22.x\nllhttp (9.4.3) on 26.x, 24.x, 22.x\nHTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846) - (High)\nA flaw in Node.js HTTP/2 handling can let retained header blocks evade maxSessionMemory\nlimits and cause remote memory exhaustion.\nImpact:\nThis vulnerability affects all users in active release lines: 24.x, 22.x\nThank you, to leduckhuong for reporting this vulnerability and thank you mcollina for fixing it.\nHTTP/2 re-entrant send can cause heap-use-after-free (CVE-2026-56848) - (High)\nA flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free.\nImpact:\nThis vulnerability affects all users in active release lines: 26.x, 24.x, 22.x\nThank you, to hahahkim for reporting this vulnerability and thank you mcollina for fixing it.\nPermission Model path matching can over-grant filesystem access (CVE-2026-58043) - (High)\nA flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\nUnder --permission , an attacker who is granted access to one path can abuse\nradix-tree prefix boundary handling to read from or write to paths outside the\nintended filesystem allowlist.\nImpact:\nThis vulnerability affects all users in active release lines: 22.x, 24.x, 26.x\nThank you, to sy2n0 for reporting this vulnerability and thank you RafaelGSS for fixing it.\nHTTPS Agent can reuse mTLS identities across PFX certificates (CVE-2026-56850) - (Medium)\nA flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\nImpact:\nThis vulnerability affects all users in active release lines: 26.x, 24.x, 22.x\nThank you, to yottt for reporting this vulnerability and thank you RafaelGSS for fixing it.\nHTTPS Agent session reuse can skip hostname verification (CVE-2026-58040) - (Medium)\nAn incomplete fix for CVE-2026-48934 has been identified in Node.js. HTTPS Agent\nTLS session reuse can skip hostname verification across identity policies.\nImpact:\nThis vulnerability affects all users in active release lines: 26.x, 24.x, 22.x\nThank you, to vnyuh for reporting this vulnerability and thank you mcollina for fixing it.\nnode:sqlite SQLTagStore iterator replay can re-execute writes (CVE-2026-58041) - (Medium)\nA flaw in node:sqlite allows a stale StatementSyncIterator created through\nDatabaseSync#createTagStore() to continue executing a cached prepared statement\nafter it has been reset and rebound with new parameters. SQLTagStore resets\ncached statements using sqlite3_reset() directly, bypassing the iterator\ninvalidation mechanism introduced for StatementSync in recent releases.\nImpact:\nThis vulnerability affects all users in active release lines: 26.x, 24.x\nThank you, to cantina-security for reporting this vulnerability and thank you mcollina for fixing it.\ndns.resolveAny() can abort on DNS responses with many A records (CVE-2026-58042) - (Medium)\nA flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS\nresponse contains more than 256 A records.\nRepeated triggering of this condition can lead to denial of service.\nImpact:\nThis vulnerability affects all users in active release lines: 26.x, 24.x, 22.x\nThank you, to cantina-security for reporting this vulnerability and thank you RafaelGSS for fixing it.\nnode:zlib sync APIs can crash on spoofed TypedArray length (CVE-2026-58045) - (Medium)\nA flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the process to crash.\nRepeated exploitation of this condition can result in a denial of service.\nImpact:\nThis vulnerability affects all users in active release lines: 26.x, 24.x, 22.x\nThank you, to byvini for reporting this vulnerability and thank you RafaelGSS for fixing it.\nPermission Model allows trace events to write outside the allowlist (CVE-2026-56847) - (Low)\nA flaw in Node.js Permission Model enforcement allows\ntrace_events.createTracing().enable() to write trace logs outside\n--allow-fs-write paths.\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\nImpact:\nThis vulnerability affects all users of the Permission Model in active release lines: 26.x, 24.x, 22.x\nThank you, to 0xoroot for reporting this vulnerability and thank you RafaelGSS for fixing it.\nPermission Model allows process reports to write outside the allowlist (CVE-2026-58039) - (Low)\nA flaw in Node.js Permission Model enforcement allows process.report to write\nand overwrite files outside --allow-fs-write paths.\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\nImpact:\nThis vulnerability affects all users in active release lines: 26.x, 24.x, 22.x\nThank you, to sinan-polat for reporting this vulnerability and thank you RafaelGSS for fixing it.\nHTTP parser header truncation can enable request smuggling (CVE-2026-58044) - (Low)\nA flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.\nNode.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers , req.rawHeaders , and req.headersDistinct , while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.\nImpact:\nThis vulnerability affects all users in active release lines: 26.x, 24.x, 22.x\nThank you, to yushengchen for reporting this vulnerability and thank you mcollina for fixing it.\nDownloads and release details\nNode.js v22.23.2\nNode.js v24.18.1\nNode.js v26.5.1\n(Update 28-July-2026) Security releases postponed\nThe Node.js project is delaying the planned security releases until Wednesday,\nJuly 29, 2026 due to infrastructure issues.\n(Update 27-July-2026) Security releases postponed\nThe Node.js project is delaying the planned security releases until Tuesday,\nJuly 28, 2026 due to the need for additional testing and validation.\nSummary\nThe Node.js project will release new versions of the 26.x, 24.x, 22.x\nreleases lines on or shortly after, Tuesday, July 28, 2026 in order to address:\nThe highest severity issue fixed in this release is HIGH.\nImpact\nThe highest severity issue fixed in the 26.x release line is HIGH.\nThe highest severity issue fixed in the 24.x release line is HIGH.\nThe highest severity issue fixed in the 22.x release line is HIGH.\nIt&#x27;s important to note that End-of-Life versions are always affected when a security release occurs.\nTo ensure your system&#x27;s security, please use an up-to-date version as outlined in our\nRelease Schedule .\nRelease timing\nReleases will be available on, or shortly after, Tuesday, July 28, 2026.\nContact and future updates\nThe current Node.js security policy can be found at https://nodejs.org/en/security/ .\nPlease follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous Wednesday, October 21, 2026 Security Releases Next Thursday, June 18, 2026 Security Releases","summary":"Node.js July 2026 security releases fix multiple flaws in the 22.x, 24.x and 26.x lines, including HTTP/2 heap-use-after-free, Permission Model filesystem over-grants, HTTPS Agent mTLS and hostname-verification bypasses, and DoS crashes in dns and zlib. An attacker can crash servers, read or write files outside the allowlist, reuse client identities, or on some HTTP/2 paths potentially run code, depending on the flaw.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["22.23.2"],"affected":">= 22.0.0, < 22.23.2","ecosystem":"node"},{"name":"node","fixed":["24.18.1"],"affected":">= 24.0.0, < 24.18.1","ecosystem":"node"},{"name":"node","fixed":["26.5.1"],"affected":">= 26.0.0, < 26.5.1","ecosystem":"node"}],"ecosystems":["node"],"tags":["http2","https-agent","node","node.js","permission-model","runtime","self-hosted"],"not_affected_if":["already-on-fixed-version","no-http2-use","no-permission-flag"],"how_to_check":"node -v\nIf the version is below 22.23.2, 24.18.1 or 26.5.1 for your release line, you are exposed.\nCheck whether your app uses node:http2, --permission, node:sqlite createTagStore, or forwarding proxies that rebuild headers.","fix":"Upgrade to Node.js 22.23.2, 24.18.1 or 26.5.1 for your release line.\nEnd-of-Life Node.js versions are also affected and have no fix; move to a supported line.","status":"open","published_at":"2026-07-29T00:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-23T21:57:11+00:00","updated_at":"2026-10-25T03:07:43+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:57:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to Node.js 22.23.2, 24.18.1 or 26.5.1 for your release line.\nEnd-of-Life Node.js versions are also affected and have no fix; move to a supported line.","reach":"internet","impact":"high","summary":"Node.js July 2026 security releases fix multiple flaws in the 22.x, 24.x and 26.x lines, including HTTP/2 heap-use-after-free, Permission Model filesystem over-grants, HTTPS Agent mTLS and hostname-verification bypasses, and DoS crashes in dns and zlib. An attacker can crash servers, read or write files outside the allowlist, reuse client identities, or on some HTTP/2 paths potentially run code, depending on the flaw.","category":"runtime","who_cares":["node.js","self-hosted","http2","permission-model","https-agent"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote memory exhaustion, process crashes, or heap corruption from HTTP/2 traffic.","analyst_note":"Confirm per-CVE auth and exploitability requirements at https://nodejs.org/en/blog/vulnerability/july-2026-security-releases, especially whether CVE-2026-56848 is remotely exploitable for code execution.","how_to_check":"node -v\nIf the version is below 22.23.2, 24.18.1 or 26.5.1 for your release line, you are exposed.\nCheck whether your app uses node:http2, --permission, node:sqlite createTagStore, or forwarding proxies that rebuild headers.","needs_analyst":true,"not_affected_if":["already-on-fixed-version","no-http2-use","no-permission-flag"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000891,"input_tokens":5787,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':167C,231C,308C,402C,477C,485C,546C,640C,719C '-48934':486C '-56846':168C '-56848':232C '-56850':403C '-58040':478C '-58041':547C '-58042':641C '-58043':309C '-58045':720C '2026':5A,12A,34B '22':42B,118C,148C,157C,201C,280C,371C,451C,518C,689C '24':44B,116C,146C,155C,199C,278C,373C,449C,516C,610C,687C '256':661C '26':47B,114C,144C,153C,276C,375C,447C,514C,608C,685C '29':4A '6.28.0':142C '7.29.0':141C '8.9.0':140C '9.4.3':151C 'abort':631C,651C 'abus':342C 'access':306C,323C,337C 'across':324C,398C,430C,501C 'activ':196C,273C,368C,444C,511C,605C,682C 'address':136C 'affect':192C,269C,364C,440C,507C,601C,678C 'agent':22B,64B,393C,410C,469C,493C 'allow':240C,421C,554C,726C 'allowlist':89B,360C 'api':711C,741C 'array':418C 'assert':735C 'attack':79B,333C 'avail':107C,111C 'block':180C 'boundari':329C,347C 'bypass':70B,163C,587C 'bytelength':730C 'cach':566C,581C 'call':247C 'cantina':616C,695C 'cantina-secur':615C,694C 'caus':185C,224C,414C,648C,742C 'certif':400C,436C 'client':91B,425C,435C 'code':100B 'collis':420C 'condit':668C 'configur':432C 'connect':411C 'contain':658C 'continu':563C 'crash':73B,81B,713C,746C 'creat':558C 'createtagstor':561C 'cve':166C,230C,307C,401C,476C,484C,545C,639C,718C 'databasesync':560C 'denial':672C 'depend':101B,133C 'differ':434C 'direct':586C 'dns':75B,633C,656C 'dns.resolveany':629C,649C 'dos':72B 'enforc':317C 'entrant':221C,250C 'evad':181C 'execut':257C,543C,564C 'exhaust':188C 'exploit':748C 'file':86B 'filesystem':59B,305C,322C,359C 'fix':37B,216C,295C,390C,466C,482C,533C,627C,706C 'flaw':39B,104B,171C,235C,312C,406C,550C,644C,723C 'follow':125C,132C 'free':56B,229C,265C 'grant':62B,304C,321C,336C 'hahahkim':285C 'handl':175C,239C,348C 'header':161C,179C 'heap':53B,226C,262C 'heap-use-after-fre':52B,225C,261C 'high':169C,233C,310C 'host':31B 'hostnam':68B,474C,499C 'hostname-verif':67B 'http/2':51B,96B,159C,174C,218C,238C 'http2':19B 'https':21B,63B,392C,409C,468C,492C 'https-agent':20B 'ident':92B,397C,426C,502C 'identifi':489C 'impact':189C,266C,361C,437C,504C,598C,675C 'includ':50B,130C 'incomplet':481C 'intend':358C 'introduc':592C 'invalid':590C 'issu':126C 'iter':538C,589C 'juli':3A,33B 'july':11A 'key':419C 'lead':670C 'leduckhuong':206C 'length':717C 'let':177C 'limit':165C,183C 'line':49B,122C,198C,275C,370C,446C,513C,607C,684C 'llhttp':150C 'mani':636C 'match':300C 'maxsessionmemori':164C,182C 'mcollina':214C,293C,531C,625C 'mechan':591C 'medium':404C,479C,548C,642C,721C 'mem':243C,254C 'memori':187C 'model':27B,58B,298C,316C 'mtls':65B,396C,424C 'multipl':38B 'mutual':422C 'new':577C 'nghttp2':241C,252C 'node':16A,17A,18A,23B,535C,552C,708C,739C 'node.js':1A,24B,32B,120C,173C,237C,314C,408C,491C,646C,725C 'nodejs':10A 'o':749C 'object':417C 'object-array':416C 'one':339C 'outsid':87B,356C 'over-gr':60B,302C,319C 'paramet':578C 'path':97B,299C,340C,355C 'permiss':26B,57B,297C,315C,331C 'permission-model':25B 'pfx':399C,415C 'polici':503C 'potenti':98B 'prefix':328C,346C 'prepar':567C 'process':653C,744C 'public':137C 'radix':326C,344C 'radix-tre':325C,343C 'rafaelgss':388C,464C,704C 're':220C,249C,542C 're-entr':219C,248C 're-execut':541C 'reachabl':734C 'read':83B,350C 'rebound':575C 'recent':596C 'record':638C,663C 'recv':255C 'releas':7A,36B,106C,121C,129C,197C,274C,369C,445C,512C,597C,606C,683C 'releases':15A 'remot':186C 'repeat':664C,747C 'replay':539C 'report':208C,287C,382C,458C,525C,619C,698C 'request':431C 'reset':573C,580C,585C 'respons':634C,657C 'result':258C 'retain':160C,178C 'reus':90B,395C,412C,429C,471C,496C 'run':99B 'runtim':28B 'secur':6A,35B,105C,128C,617C,696C 'security':14A 'security-releases':13A 'self':30B 'self-host':29B 'send':222C,244C 'server':82B 'servic':674C 'session':242C,253C,470C,495C 'skip':473C,498C 'spoof':715C,728C 'sqlite':536C,553C 'sqlite3':584C 'sqltagstor':537C,579C 'stale':556C 'statement':568C,582C 'statementsync':594C 'statementsynciter':557C 'sy2n0':380C 'sync':710C 'synchron':738C 'thank':203C,212C,282C,291C,377C,386C,453C,462C,520C,529C,612C,623C,691C,702C 'tls':423C,494C 'tree':327C,345C 'trigger':665C,732C 'typedarray':716C,729C 'undici':139C 'updat':108C,134C 'use':54B,227C,263C,583C 'user':194C,271C,366C,442C,509C,603C,680C 'verif':69B,475C,500C 'vnd':9A 'vnd-nodejs-july':8A 'vnyuh':523C 'vulner':138C,191C,210C,268C,289C,363C,384C,439C,460C,506C,527C,600C,621C,677C,700C 'wednesday':2A 'write':85B,353C,544C 'x':43B,45B,48B,115C,117C,119C,145C,147C,149C,154C,156C,158C,200C,202C,277C,279C,281C,372C,374C,376C,448C,450C,452C,515C,517C,519C,609C,611C,686C,688C,690C 'yottt':456C 'zlib':77B,709C,740C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"july-2026-security-releases","url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases","severity":"high","published_at":"2026-07-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T10:32:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}