Loading the post…
TL;DR — last updated 2026-11-11 22:40 UTC
Node.js published security releases on November 11, 2026: v22.23.5, v24.22.3, and v26.13.1. They fix 16 vulnerabilities, seven of them rated High. Most are in HTTP/2 and TLS handling, where an unauthenticated client can crash a server, read memory belonging to other connections, or get past per-host client-certificate checks. No CVSS scores had been published at the time of writing.
alt-nodejs version that Node.js Selector offers, end-of-life versions included, and ea-nodejs22 on cPanel servers. See Which versions are affected?alt-nodejs packages are out for every version built for CloudLinux 7, 8, and 9 and CloudLinux for Ubuntu 22.04, except alt-nodejs20 on CloudLinux 7 and CloudLinux for Ubuntu 22.04. On CloudLinux 10, alt-nodejs 20, 18, 14, and 12 are still to come. ea-nodejs22 is released too, for cPanel servers on CloudLinux 8. See Which fixed packages are out?alt-nodejs or ea-nodejs22 package against the fixed versions. See How to verify you are patched.CloudLinux delivers Node.js to hosting accounts as alt-nodejs packages, the versions Node.js Selector offers each account. A fix published on nodejs.org reaches your servers only when we rebuild those packages and you install them.
Each account picks its own Node.js version in Node.js Selector, so one server can run several at once, end-of-life versions included. Node.js fixes only 22.x, 24.x, and 26.x, and says end-of-life versions are always affected. For those, the fix is a backport by our engineers, who check each CVE against each version.
Whether an application is exposed depends on what it runs. All seven High-rated issues are in servers that Node.js runs itself: HTTP/2 servers, HTTPS servers, and other TLS servers.
Every alt-nodejs version that CloudLinux ships is affected, and so is ea-nodejs22.
| Node.js version | Affected | How it’s fixed |
|---|---|---|
| 26.x, 24.x, 22.x Supported upstream | Yes | New Node.js releases: v26.13.1, v24.22.3, and v22.23.5 |
| 20.x, 19.x, 18.x, 16.x, 14.x, 12.x, 10.x End-of-life | Yes | Our backports, on the same Node.js version |
ea-nodejs22 (cPanel, CloudLinux 8) | Yes | cPanel’s update, which we rebuild |
Which of the 16 CVEs apply depends on the version. Upstream lists five of them for 24.x and 26.x only. Our engineers' checks show that several of those five also reach the older code of the end-of-life versions, and that some of the other CVEs don’t apply to it. The full list is in What the November 2026 Node.js releases fix.
The native nodejs packages that CloudLinux ships as part of the operating system are a separate set. For those we follow Red Hat and AlmaLinux, so they are fixed when AlmaLinux ships its update. Versions that Red Hat no longer supports, such as nodejs 10 on CloudLinux 8 and 16 on CloudLinux 9, get no update this way.
means the fixed alt-nodejs package is released, and that it isn’t yet.
| alt-nodejs version | CloudLinux 7 | CloudLinux 8 | CloudLinux 9 | CloudLinux 10† | CloudLinux for Ubuntu 22.04 |
|---|---|---|---|---|---|
| 26 | Not built | Not built | |||
| 24 | Not built | ||||
| 22 | Not built | ||||
| 20 | |||||
| 19 | Not built | ||||
| 18 | |||||
| 16 | |||||
| 14 | |||||
| 12 | |||||
| 10 | Not built |
† CloudLinux 10 takes its alt-nodejs packages from TuxCare’s repositories. CloudLinux 7, 8, and 9 and CloudLinux for Ubuntu 22.04 take them from the CloudLinux repositories.
No workaround is documented upstream. The fix is the updated package. Each alt-nodejs version is a separate build with its own copy of Node.js, so updating the operating system’s nodejs packages doesn’t fix them.
Until the fixed package for your version is out, check which applications run an HTTP/2, HTTPS, or TLS server in Node.js itself. Per the Node.js advisory, an application that runs none of these is outside the seven High-rated issues. That narrows the risk without removing it, so update every version once its package is released.
Fixed packages are released one version and platform at a time. The table in Which fixed packages are out? shows which are, and the status page and the Update history announce each one. Once yours is out, update the alt-nodejs packages.
On CloudLinux 7:
yum clean all
yum update 'alt-nodejs*'On CloudLinux 8, 9, and 10:
dnf clean all
dnf upgrade 'alt-nodejs*'On CloudLinux for Ubuntu 22.04:
apt-get update && apt-get install --only-upgrade 'alt-nodejs*'On cPanel servers on CloudLinux 8:
dnf upgrade ea-nodejs22Running applications keep using the old binary until they restart. After updating, restart the Node.js applications on each account, either from Node.js Selector or with:
cloudlinux-selector restart --json --interpreter nodejs --user <user> --app-root <app_root>Check the runtime package of each installed version:
rpm -q alt-nodejs22-nodejsOn CloudLinux for Ubuntu 22.04, use dpkg-query -W alt-nodejs22-nodejs.
On 22, 24, and 26, the package is fixed at version 22.23.5, 24.22.3, or 26.13.1, or any later version. On cPanel servers, ea-nodejs22 is fixed at 22.23.5 or any later version: check it with rpm -q ea-nodejs22.
End-of-life versions keep their upstream Node.js version, so node --version doesn’t change after the update. Only the package release moves. These are the minimum fixed releases of the end-of-life packages out so far, or any later release:
alt-nodejs20: 20.20.2-17 on CloudLinux 8 and 9.alt-nodejs19: 19.9.0-14 on every platform.alt-nodejs18: 18.20.8-28 on CloudLinux 7, 8, and 9, and 18.20.8-27 on CloudLinux for Ubuntu 22.04.alt-nodejs16: 16.20.2-35 on CloudLinux 7, 8, 9, and 10, and 16.20.2-33 on CloudLinux for Ubuntu 22.04.alt-nodejs14: 14.21.3-39 on CloudLinux 7, 8, and 9, and 14.21.3-36 on CloudLinux for Ubuntu 22.04.alt-nodejs12: 12.22.12-37 on CloudLinux 7, 8, and 9, and 12.22.12-34 on CloudLinux for Ubuntu 22.04.alt-nodejs10: 10.24.1-11 on every platform.We will add the others here as they ship.
The rest of this advisory is background for readers who want it: the full list of fixes and the dependency updates in these releases. Neither is required to apply the update above.
Severity is as rated upstream. The Node.js advisory publishes no CVSS scores. The affected versions are upstream’s, for the versions it still supports.
| CVE | Issue | Severity | Affected versions |
|---|---|---|---|
| CVE-2026-123863 | HTTP/2 session teardown fails an internal assertion, so any client can abort the server | High | 26.x, 24.x |
| CVE-2026-123864 | A zero-length TLS write re-enters the HTTP parser, and an HTTPS server copies other connections' memory, TLS private keys included, into a request body | High | 26.x, 24.x, 22.x |
| CVE-2026-123865 | HTTP/2 sessions are never cleaned up after a protocol error during shutdown, leaking memory and file descriptors | High | 26.x, 24.x, 22.x |
| CVE-2026-123866 | HTTP/2 stream teardown sends freed response memory to the peer | High | 26.x, 24.x, 22.x |
| CVE-2026-126051 | A TLS server that uses SNI, OCSP, or session hooks crashes on an uncaught exception that a remote client can trigger | High | 26.x, 24.x |
| CVE-2026-123872 | TLS 1.2 renegotiation lets a client change the server name and bypass per-host client-certificate checks | High | 26.x, 24.x, 22.x |
| CVE-2026-123874 | HTTP/2 use-after-free when a respondWithFile() stream is reset during a pending write | High | 26.x, 24.x |
| CVE-2026-123828 | One-byte heap overflow in HTTP/2 session.altsvc() with a long origin | Medium | 26.x, 24.x |
| CVE-2026-123867 | A TLS SNI context that sets only a client CA falls back to the default CA, bypassing per-host mutual TLS | Medium | 26.x, 24.x, 22.x |
| CVE-2026-123868 | HTTP/2 data queued on an undrained stream isn’t counted against maxSessionMemory, so a client can exhaust server memory | Medium | 26.x, 24.x |
| CVE-2026-123871 | Proxy credentials appear in ERR_PROXY_INVALID_CONFIG error messages | Medium | 26.x, 24.x, 22.x |
| CVE-2026-123875 | Cancelling an HTTP/2 respondWithFile() download crashes the server | Medium | 26.x, 24.x, 22.x |
| CVE-2026-123877 | https.Agent reuses a TLS session across requests with different CA settings, bypassing certificate validation | Medium | 26.x, 24.x, 22.x |
| CVE-2026-123829 | Permission Model: recursive fs.watch reveals the names of files it may not read, on macOS and Windows only | Low | 26.x, 24.x, 22.x |
| CVE-2026-123862 | zlib: params() followed by destroy() throws an assertion that the application can’t catch | Low | 26.x, 24.x, 22.x |
| CVE-2026-106071 | Permission Model: a wildcard filesystem grant also matches paths shorter than its prefix | Low | 26.x, 24.x, 22.x |
Alongside the CVE fixes, upstream updated bundled dependencies:
Need help? Contact our support team
Each release notice from the CloudLinux status page is listed here, newest first.
yum update 'alt-nodejs*'rpm -qa 'alt-nodejs*'
Akos Vajda
Comments