Node.js CVE Round-Up: 11 New Vulnerabilities Affecting EOL Node.js 20

This round-up covers eleven Node.js CVEs now published in the HeroDevs Vulnerability Directory and patched by the HeroDevs security team. For the LTS and current versions the complete CVE set was fixed upstream in Node.js 26.5.1, 24.18.1, and 22.23.2. CVE-2026-48931 shipped in an earlier release and is fixed in 26.3.1, 24.17.0, and 22.23.0.

‍

All these CVEs affected at least one EOL Node.js line, all of them affected Node.js 20, which went EOL on April 30, 2026. There is no open source upstream fix available for any EOL Node.js line, and there never will be. HeroDevs exists for exactly this gap.

‍

Are your Node.js deployments running an EOL version? Explore NES for Node.js 

‍

Give me the TL;DR

If you are on Node.js 26.x, 24.x, or 22.x, upgrade to 26.5.1, 24.18.1, or 22.23.2 (or later). Each of those releases patched those CVEs, so one upgrade closes all eleven CVEs in this round-up.

‍

If you are on Node.js 20 or earlier (18, 16, 14, or 12), these eleven vulnerabilities reach at least one EOL line you may be running, including all three High-severity CVEs, and the Node.js project will not ship a fix. We covered the upstream July release and its EOL implications in our July 2026 Node.js security release breakdown.

‍

Eleven New Node.js CVEs

Severity labels below follow the HeroDevs Vulnerability Directory ratings. Scores are attributed to their source: the HackerOne CNA publishes CVSS 3.0 vectors for Node.js CVEs, and NVD publishes its own CVSS 3.1 analysis where one exists. Where the two diverge, both are shown.

‍

The July release also fixed CVE-2026-58041 in node:sqlite, which exists only in 24.x and 26.x and affects no EOL line, so it is out of scope here.

‍

_{Severity labels follow the HeroDevs Vulnerability Directory ratings. Where NVD and the HackerOne CNA diverge, both scores are shown.}

‍

New High-Severity Node.js Vulnerabilities

CVE-2026-56848 | High | HTTP/2 RST_STREAM re-entrancy heap use-after-free

A heap use-after-free (CWE-416) in the HTTP/2 server: when Node submits a RST_STREAM for a refused stream while nghttp2 is still processing received frames, Http2Stream::SubmitRstStream() forces a write that re-enters nghttp2_session_mem_send() mid-receive, freeing session state the active receive operation is still reading. The result is a remotely triggerable process crash. The HackerOne CNA scores it 7.5 High (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): network-reachable, unauthenticated, availability-only.

CVE-2026-58043 | High | Permission Model radix-tree over-grant

Under --permission, Node's filesystem allowlist is stored in a radix tree, and a flaw in prefix boundary handling (CWE-284) lets an attacker who is granted access to one path read from or write to paths outside the intended allowlist. NVD scored it 8.4 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); the HackerOne CNA scored it 7.5 High (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), with the difference turning on attack complexity. Both agree on the Scope: Changed rating, which reflects that the bug breaks out of the security boundary the Permission Model exists to enforce.

CVE-2026-56846 | High | HTTP/2 retained header blocks evade maxSessionMemory

A resource-exhaustion flaw (CWE-400) in the HTTP/2 server: retained header blocks are not counted against the maxSessionMemory limit, so a remote client can drive memory consumption past the cap and exhaust the process. The HackerOne CNA scores 7.5 High (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

‍

New Medium-Severity Node.js Vulnerabilities

CVE-2026-58040 | Medium | HTTPS Agent TLS session reuse skips hostname verification

An incomplete fix of CVE-2026-48934 from the June release: HTTPS Agent TLS session reuse can skip hostname verification across identity policies (CWE-297), so a reused session can be accepted for a host it was never verified against. The HackerOne CNA scores 6.3 Medium (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N), with Scope: Changed reflecting the crossed identity boundary.

CVE-2026-58045 | Medium | Reachable assertion in synchronous node:zlib APIs

A spoofed TypedArray byteLength triggers a reachable assertion (CWE-617) in the synchronous node:zlib functions, crashing the entire process. All eleven synchronous functions are affected. The HackerOne CNA scores 6.2 Medium (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Local attack vector, but in practice the trigger is any code path that lets untrusted input shape the object handed to a sync zlib call.

CVE-2026-58042 | Medium | dns.resolveAny() aborts the process

A DNS response containing more than 256 A records causes dns.resolveAny() to abort the Node.js process (CWE-400). An attacker who controls or can influence a DNS answer that your service resolves with resolveAny() gets a repeatable full-process crash. The HackerOne CNA scores 5.9 Medium (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVE-2026-56850 | Medium | HTTPS Agent reuses mTLS client identities

A connection-reuse flaw (CWE-287) in the HTTPS Agent: PFX object-array key collisions can cause mutual TLS client identities to be reused across requests configured with different client certificates. A request meant to authenticate as client A can go out on a pooled connection authenticated as client B. NVD scored 4.4 Medium (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N); the HackerOne CNA scores 4.1 Medium. Most relevant to multi-tenant services and API gateways that hold different client certificates per tenant.

‍

New Low-Severity Node.js Vulnerabilities

CVE-2026-58044 | Low | Header truncation hides Content-Length from proxies

Node's HTTP client can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct while still using the omitted headers internally for message framing (CWE-444). A forwarding proxy that rebuilds outbound headers from the visible set while piping the original body to a reused backend connection can desynchronize, with Content-Length hidden from userland but the body still delivered. The HackerOne CNA scores 3.7 Low (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Rated Low, but request-smuggling primitives punch above their score in proxy-heavy architectures.

CVE-2026-56847 | Low | trace_events writes outside the Permission Model allowlist

trace_events.createTracing().enable() writes trace logs outside the --allow-fs-write allowlist (CWE-862). Worth noting the score spread: the HackerOne CNA rates it 3.3 Low (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), while NVD's own analysis rates it 6.1 Medium (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), crediting a confidentiality impact the CNA does not.

CVE-2026-58039 | Low | process.report writes outside the Permission Model allowlist

The sibling bypass: process.report can write and overwrite files outside --allow-fs-write paths (CWE-284). The HackerOne CNA scores 3.3 Low (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Same exposure shape as CVE-2026-56847: a diagnostic subsystem that never consulted the allowlist.

CVE-2026-48931 | Low | HTTP Agent accepts a response before the request is sent

The one June-release entry in the round-up. A race condition (CWE-367) in the HTTP Agent lets a client accept as valid a response that arrives before the client has sent the request, a protocol-integrity flaw relevant to connection reuse against misbehaving or malicious upstreams. Both NVD and the HackerOne CNA score it 3.7 Low (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

‍

Are these Node.js CVEs being exploited?

None of the eleven CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of August 27, 2026, and neither the Node.js project nor the reporting researchers have published working exploits. No active exploitation has been reported. Two caveats keep that from being comfortable. The public regression test for CVE-2026-56848 documents its triggering frame sequence, a short, deterministic sequence over a single connection, which meaningfully lowers the bar for anyone building a crasher. And several of the other availability bugs have simple triggers described in the upstream advisories (an oversized DNS answer for CVE-2026-58042, a malformed TypedArray for CVE-2026-58045). Treat the absence of a public exploit as a snapshot, not a barrier, and patch on that basis.

‍

EOL Exposure Gap

This batch matters because Node.js 20 reached end of life on April 30, 2026, and Node.js 18 on April 30, 2025. Upstream advisories list only actively assessed lines, so an operator reading the July advisory sees 26.x, 24.x, and 22.x and can wrongly conclude older lines are clear. The CVE records and the HeroDevs Directory entries tell the fuller story: all of these eleven CVEs affect EOL versions. That gap widens with every security release, and it is invisible to any audit that only checks the upstream advisory page. For the deeper dive on that dynamic, see Node.js 20 goes EOL: how to stay secure without a full migration.

‍

Which EOL Node.js versions are affected by these CVEs?

This is the table upstream advisories cannot give you. The Node.js project stops assessing a release line the day it goes EOL, so the recent advisories say nothing about Node.js 20 and earlier, and silence is easy to misread as safety. 

‍

HeroDevs NES for Node.js actively provides security patches for all vulnerabilities affecting these EOL versions from 12 to 20.

‍

_{Affected end-of-life Node.js release lines. “Yes” means the CVE reaches that line and no upstream fix exists or ever will.}

‍

How do I mitigate these Node.js vulnerabilities?

The right move depends entirely on which release line you are running, so the table below is organized by scenario rather than by CVE.

‍

‍

Taking Action

If you run Node.js 26.x, 24.x, or 22.x, upgrade to the latest versions 26.8.1, 24.20.0, or 22.23.2. One upgrade closes all eleven CVEs in this round-up, and the July release is worth taking whole rather than cherry-picking.

‍

The harder decision belongs to teams still on Node.js 20, 18, or earlier. Every security release widens that gap, and the absence of an EOL line from an upstream advisory is a statement about who is looking, not about whether the code is safe.

‍

HeroDevs is an official Node.js partner through the OpenJS Foundation, and NES for Node.js delivers drop-in replacement builds that resolve these vulnerabilities on EOL Node.js lines without forcing a runtime migration you are not ready for. Confirm coverage for your version, or talk to our team about scoping an EOL Node.js estate.

‍

Frequently asked questions

Will the Node.js project fix any of these vulnerabilities on Node.js 20, 18 or earlier? 

No. Node.js 18 reached end of life on April 30, 2025 and Node.js 20 on April 30, 2026, earlier versions are all EOL. The project does not assess or patch EOL lines, which is also why those lines are absent from the upstream advisories rather than marked "not affected."

‍

Why do some of these Node.js CVEs carry two different CVSS scores? 

The HackerOne CNA that assigns Node.js CVEs publishes CVSS 3.0 vectors, and NVD later publishes its own CVSS 3.1 analysis, which can weigh metrics differently. The widest spread in this round-up is CVE-2026-56847, rated 3.3 Low by the CNA and 6.1 Medium by NVD.

‍

Do the Permission Model CVEs affect me if I never use --permission?

No. All three (CVE-2026-58043, CVE-2026-56847, CVE-2026-58039) require the Permission Model to be enabled; a process that does not pass the flag consults no allowlist. Also note that Node.js 18 and earlier do not ship the Permission Model at all, so those lines are not affected by these three even though they are EOL.

‍

Do I need to change my code to use HeroDevs NES for Node.js? 

No. NES provides drop-in patched builds that replace your existing Node.js runtime. There are no API changes, no dependency updates, and no modifications required to your application code.

‍

Is HeroDevs an official Node.js support provider? 

HeroDevs is a founding member of the OpenJS Foundation's Ecosystem Sustainability Program (ESP), the formal framework through which commercial vendors provide long-term support for Node.js and other OpenJS projects. NES for Node.js is sanctioned through that program.