Node.js 26.13.1 (LTS) released with critical security fixes for HTTP/2 and TLS

Node.js has released version 26.13.1, a security-focused update for the 'Lithium' Long Term Support (LTS) branch. The release primarily targets several high-severity vulnerabilities affecting the core networking stack, specifically within the HTTP/2 and TLS modules.

Developers and system administrators using Node.js in production environments are encouraged to update immediately to mitigate risks. The update also includes several medium and low-severity fixes, alongside dependency updates for Brotli, llhttp, SQLite, and Undici.

Security and dependency improvements in Node.js 26.13.1

• HTTP/2 Vulnerabilities: Multiple high-severity fixes address stream management, including releasing headers when streams are removed (CVE-2026-123863), detecting abandoned streams from nghttp2 (CVE-2026-123865), and retaining buffers/streams during pending socket writes (CVE-2026-123866, CVE-2026-123874).
• TLS/SSL Hardening: High-severity patches prevent nested parser execution from empty writes (CVE-2026-123864) and fix a remotely reachable server crash (CVE-2026-126051). Additionally, the release restricts TLS resumption and renegotiation from changing the Server Name Indication (SNI) context.
• Data Integrity and Memory: The update includes a medium-severity fix to charge inbound DATA retained by streams against the maxSessionMemory limit (CVE-2026-123868) and prevents ALTSVC buffer overflows (CVE-2026-123828).
• Dependency Updates: The release bumps several core dependencies, including Brotli to 1.2.1, llhttp to 9.4.4, SQLite to 3.54.1, and Undici to 8.12.4.

Why it matters

As an LTS release, this update is critical for enterprise software engineers and DevOps teams maintaining stable production environments. The fixes in the HTTP/2 and TLS layers are essential for preventing potential Denial of Service (DoS) attacks and unauthorized session manipulations in web-facing applications.