Node.js Ships Twice-Delayed July Security Release Patching 11 CVEs as Node 18 and 20 Sit Fully Unpatched
Node.js shipped 11 CVE fixes across three High-severity HTTP/2 and Permission Model bugs on July 29, after two delays, while EOL versions 18 and 20 get nothing upstream.
Overview
The Node.js project shipped its July 2026 security release on Wednesday, July 29, after slipping twice from its original schedule, according to the Node.js blog. The release patches 11 CVEs — three rated High, five Medium, and three Low — across the 22.x, 24.x, and 26.x lines, landing as v22.23.2, v24.18.1, and v26.5.1. Node.js 18 and 20, both now past end of life, receive none of the fixes.
What We Know
The release slipped twice before shipping. An update dated July 27 stated the project was “delaying the planned security releases until Tuesday, July 28, 2026 due to the need for additional testing and validation,” and a second update the next day pushed it again, saying releases were delayed “until Wednesday, July 29, 2026 due to infrastructure issues,” according to the Node.js blog.
Of the three High-severity issues, two sit in HTTP/2 handling. CVE-2026-56846 is described by the Node.js blog as a flaw where “retained header blocks evade maxSessionMemory limits and cause remote memory exhaustion.” CVE-2026-56848 allows “nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free,” per the Node.js blog. NVD lists a CNA-assessed base score of 7.5 (High) for CVE-2026-56848, network-exploitable with no authentication or user interaction required, though NVD’s own assessment is not yet provided.
The third High-severity bug affects the Permission Model. CVE-2026-58043 lets an attacker “abuse radix-tree prefix boundary handling to read from or write to paths outside the intended filesystem allowlist” under the --permission flag, the Node.js blog says. NVD records a CNA-assessed base score of 7.5 (High) for that bug as well, though it requires local access and high attack complexity per its CVSS vector.
Two more Low-severity Permission Model bugs shipped in the same release: CVE-2026-56847, which lets trace_events.createTracing().enable() “write trace logs outside --allow-fs-write paths,” and CVE-2026-58039, which lets process.report “write and overwrite files outside --allow-fs-write paths,” according to the Node.js blog. HeroDevs frames this pattern bluntly, writing that “Permission Model bypasses have now appeared in every Node.js security release of 2026.”
The Medium-severity bugs span the HTTPS Agent, node:sqlite, DNS resolution, and node:zlib. CVE-2026-56850 allows “PFX object-array key collisions,” letting “mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates,” while CVE-2026-58040 is described as “an incomplete fix for CVE-2026-48934” that lets “HTTPS Agent TLS session reuse skip hostname verification across identity policies,” per the Node.js blog. CVE-2026-58041 involves a stale StatementSyncIterator in node:sqlite that can “continue executing a cached prepared statement after it has been reset and rebound with new parameters.” CVE-2026-58042 can cause dns.resolveAny() to “abort the process when a DNS response contains more than 256 A records,” with repeated triggering leading to denial of service. CVE-2026-58045 allows “a spoofed TypedArray byteLength” to crash the process via the synchronous node:zlib APIs.
The remaining Low-severity bug, CVE-2026-58044, affects the HTTP parser. The Node.js blog describes it as causing “a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.” Digital Applied characterizes the same bug as one that “can enable request smuggling.”
The release also bundled dependency updates: undici to 8.9.0, 7.29.0, and 6.28.0 across the three lines, and llhttp to 9.4.3, according to the Node.js blog.
None of the fixes reach Node.js 18 or 20. According to HeroDevs, “Node.js 18 reached end of life on April 30, 2025” and “Node.js 20 reached end of life on April 30, 2026,” meaning both lines are now fully outside upstream support. Digital Applied similarly notes that “Node 20 and every earlier line are End-of-Life and receive no patches from this release.” Despite that, HeroDevs reports that “Node 20 pulled roughly 103.8 million downloads” and “Node 18, fifteen months past end of life, added another 32.7 million” in July 2026 alone, putting combined downloads of the two unsupported lines at “more than 136 million times in July,” by HeroDevs’ own accounting.
As previously reported, Node.js’s June 2026 security release patched 12 CVEs while Node 20 was already flagged as running without upstream fixes; the July release marks the first cycle in which both Node 18 and Node 20 sit outside support simultaneously.
What We Don’t Know
NVD has not yet published its own independent CVSS assessment for CVE-2026-56848 or CVE-2026-58043; the 7.5 scores currently listed come from the reporting CNA (HackerOne) rather than NIST’s own analysis. The Node.js blog does not disclose CVSS scores or vector strings for the remaining eight CVEs in the release. It is also not stated how many production deployments running Node 18 or 20 are covered by third-party extended-support offerings such as HeroDevs’ paid patches, versus running fully unpatched.
Analysis
The back-to-back delays — first for “additional testing and validation,” then for “infrastructure issues” — pushed the release two days past its original target, an unusual slip for a project that ships security fixes on a fixed monthly cadence. The recurrence of Permission Model bypasses, which HeroDevs says have now shown up in “every Node.js security release of 2026,” points to --permission sandboxing as an area still maturing under adversarial testing even as more teams adopt it as a security boundary rather than an experimental flag.