Node.js Releases 10 Emergency CVEs with High Vulnerabilities in HTTP/2 and the Permission Model

The Node.js Foundation published a security update on Wednesday, July 29, that addresses 10 vulnerabilities in a single release window, three of which are classified as HIGH. Versions 22.23.2, 24.18.1, and 26.5.1 include the patches along with bumps in undici (to 6.28.0, 7.29.0, and 8.9.0) and in the llhttp parser to 9.4.3. The release was initially scheduled for July 28 but was delayed 24 hours due to infrastructure issues on the release team.

The proportion of HIGH vulnerabilities is notable: in previous 2026 releases, Node.js issued between one and two critical fixes per quarter. Three at once, all with network vectors or sandbox escape, marks the second instance in five years in which the 24 LTS line has received patches equivalent in weight to those of the 2021 releases, following the HTTP/1.1 request smuggling bugs.

What's in Each HIGH

CVE-2026-56846 affects the HTTP/2 server in lines 22 and 24. Headers retained in the HTTP/2 session can escape the maxSessionMemory limit, paving the way for remote memory exhaustion without authentication. A malicious client, a long session, and a sequence of large, well-formed headers are all that is required. Mitigating this without a patch involves reducing maxHeaderListPairs and maxSessionMemory to aggressive values, at the cost of compatibility with real clients.

CVE-2026-56848 affects all three active lines. It is a use-after-free in nghttp2_session_mem_send when the session sending is re-entered during a callback. This issue can be exploited with forged HTTP/2 packets that force the server into a sending loop within another, and the resulting heap corruption allows for arbitrary code execution in realistic scenarios. The nghttp2 upstream team had already been notified prior to the coordinated disclosure.

CVE-2026-58043 impacts the Permission Model, a functionality added in Node 20 to restrict file and network calls via the --allow-fs-read and --allow-fs-write flags. The bug lies in the radix-tree structure that matches path prefixes: an application authorized to read /var/data can, through a prefix boundary abuse, read /var/data.pem or /var/database, files that the operator believed were outside the allowlist. For those relying on the Permission Model to isolate plugins or third-party functions within the same process, the assumption of containment does not hold until the upgrade.

A Message About the Permission Model

The fix itself is straightforward. What matters is the pattern. The Permission Model was promoted from experimental to stable in the Node 22 cycle, and platform teams in fintech, service providers, and SaaS have begun incorporating it as a cost-effective layer of defense against malicious third-party libraries. With CVE-2026-58043 and the three additional LOW vulnerabilities in this round (58039, 56847, 58044) showing that the Permission Model has holes in at least four independent paths, the CISO who signed off on the RCE waiver for a critical application based on this mitigation needs to re-open the risk analysis.

The sensible read is not to abandon the feature, but to downgrade the credit it receives in the threat model. Process separation, seccomp, and cgroups continue to deliver guarantees that the pure Permission Model has yet to provide.

Where the Pain Hits First

In the United States, serverless platform providers running client functions over managed Node.js runtimes, such as AWS Lambda, Vercel, and Cloudflare, need to decide whether to roll out the new version before regular maintenance or apply mitigation via a WAF in front of HTTP/2. AWS has historically published the schedule with a two to four day delay relative to the upstream release, and Enterprise customers typically receive specific notice about HTTP/2 before the general public.

In Brazil, fintechs and companies in the payments sector are heavy users of the runtime, including Nubank, Stone, and Ebanx. For SRE teams maintaining a large fleet on Node 22 outside of automatically updated containers, this release necessitates a deploy window outside of business hours in the coming days. In India, TCS and Infosys support corporate back-ends for global clients running Node.js on support contracts, and the application security team of those partners is often the first to be asked for proof of patch.

The llhttp Detail

While focus is on HTTP/2, the silent bump of llhttp to 9.4.3 addresses CVE-2026-58044 for request smuggling in HTTP/1.1 when headers are truncated. This type of fix rarely makes headlines and often appears in the post-mortem of incidents in the following quarter. It's worthwhile to update even in services that already block HTTP/2 by policy, as many financial API brokers still do.