# Node.js 26.13.1 (LTS) released with critical security fixes for HTTP/2 and TLS

> **Key takeaway:** This Long Term Support (LTS) security release addresses multiple high-severity vulnerabilities in the HTTP/2 and TLS implementations.

**Published:** 2026-11-11T16:45:20+00:00 
**Source:** Node.js Official Releases 
**Category:** software-engineering 
**Canonical URL:** https://fosswire.org/news/nodejs-26131-lts-released-with-critical-security-fixes-for-h.html 

## Summary
Node.js has released version 26.13.1, a security-focused update for the 'Lithium' Long Term Support (LTS) branch. The release primarily targets several high-severity vulnerabilities affecting the core networking stack, specifically within the HTTP/2 and TLS modules.

Developers and system administrators using Node.js in production environments are encouraged to update immediately to mitigate risks. The update also includes several medium and low-severity fixes, alongside dependency updates for Brotli, llhttp, SQLite, and Undici.

## Security and dependency improvements in Node.js 26.13.1
- **HTTP/2 Vulnerabilities:** Multiple high-severity fixes address stream management, including releasing headers when streams are removed (CVE-2026-123863), detecting abandoned streams from nghttp2 (CVE-2026-123865), and retaining buffers/streams during pending socket writes (CVE-2026-123866, CVE-2026-123874).
- **TLS/SSL Hardening:** High-severity patches prevent nested parser execution from empty writes (CVE-2026-123864) and fix a remotely reachable server crash (CVE-2026-126051). Additionally, the release restricts TLS resumption and renegotiation from changing the Server Name Indication (SNI) context.
- **Data Integrity and Memory:** The update includes a medium-severity fix to charge inbound DATA retained by streams against the maxSessionMemory limit (CVE-2026-123868) and prevents ALTSVC buffer overflows (CVE-2026-123828).
- **Dependency Updates:** The release bumps several core dependencies, including Brotli to 1.2.1, llhttp to 9.4.4, SQLite to 3.54.1, and Undici to 8.12.4.

## Why it matters
As an LTS release, this update is critical for enterprise software engineers and DevOps teams maintaining stable production environments. The fixes in the HTTP/2 and TLS layers are essential for preventing potential Denial of Service (DoS) attacks and unauthorized session manipulations in web-facing applications.