Node.js Patches 16 Vulnerabilities Exposing TLS Private Keys and Cross-Connection Data
The Node.js project has published fixes for 16 vulnerabilities, seven of them rated high severity. The most critical flaw, CVE-2026-123864, enables an unauthenticated client to read memory belonging to other connections on HTTPS servers. This memory may contain TLS private keys and requests from other users.
The three actively supported release lines were impacted. Exploitation requires a specific condition in application code: the server must invoke res.flushHeaders() before the full request body arrives and later call res.end() with data. Reading the leaked memory also needs a route that returns or stores the request body. Servers using the node:http module were not affected.
CVE-2026-123863 crashes servers that use the built-in HTTP/2 support in the 24.x and 26.x lines. A standard HTTP/2 server that responds before the request body is complete is sufficient to trigger the issue. The attack works over both TLS and plaintext and requires no authentication.
CVE-2026-123866 causes the server to send fragments of its own memory to the client, including responses from other connections, across all three supported lines. From versions 24.22.0 and 26.9.0 onward, a single client can trigger the flaw. Earlier builds require the server to terminate a stream mid-response.
Among other high-severity issues, CVE-2026-123865 makes any standard HTTP/2 server retain memory and file descriptors permanently. CVE-2026-123874 corrupts memory in the 24.x and 26.x lines when using stream.respondWithFile() or stream.respondWithFD(). CVE-2026-126051 crashes TLS servers that employ SNICallback, OCSPRequest, newSession, resumeSession hooks or server.addContext(). CVE-2026-123872 concerns TLS 1.2 renegotiation, allowing an approved client for one hostname to switch to another with stricter certificate rules without satisfying those rules.
The corrected versions are 22.23.5, 24.22.3 and 26.13.1. End-of-life branches, including 20.x and 25.x, received no fixes and are stated to be always vulnerable. The only recommended mitigation is to update; the advisory lists no workarounds. All reported flaws reside in the HTTP/2, HTTPS and TLS server code of Node.js itself and affect environments where the process directly accepts such connections. No in-the-wild exploitation has been reported, and the project does not indicate whether TLS keys must be rotated.
Related articles
Telegram Patches RCE Vulnerabilities in HTML Widgets After Researcher Demonstrates Calculator Exploit
Telegram introduced HTML widgets for bots in early November, allowing JavaScript execution inside messages via the QuickJS engine. Security researcher V12 quickly demonstrated remote code execution by launching the system calculator on Android. Pavel Durov responded that no vulnerability existed because the user had to first start the bot, yet server-side fixes were deployed anyway. Multiple use-after-free and use-after-return bugs were identified in QuickJS and QuickJS-ng, some discovered with AI assistance from Claude Fable 5.1 and Mythos 5.2. Telegram isolated the widget engine into a separate process on Android, added syscall filtering, and limited nested graphical effects to prevent crashes. Desktop clients received the fixes across versions 7.4.2 and 7.4.3, while widgets were temporarily restricted server-side. Users are advised to update to Android 13.2.2 or Desktop 7.4.3 and avoid unknown bots.
Telegram Patches Critical QuickJS Sandbox Escape Vulnerability in Android Update 13.2.2
Telegram has released version 13.2.2 for Android to address a high-severity vulnerability in its HTML widgets for bots. The flaw resided in the QuickJS JavaScript engine within Telegram's QuickJS-ng fork and allowed scripts in ordinary messages to break out of the sandbox and execute native code on the device. The root cause was improper handling of the await using construct inside non-async functions, which triggered a use-after-return condition by freeing local variable references while nested functions still accessed the stack. The vulnerable code entered the QuickJS-ng main branch on May 16 as part of explicit resource management support. Security researcher Andreas Rösler discovered the issue during an AI-assisted audit with Anthropic's Claude model that identified 27 findings total. The patch enforces a syntax error on the invalid construct and was merged on November 10, the same day the Android release became available. Although reported against Android 13.2.1, the bug affected every platform using the affected engine fork.
Microsoft Confirms November Windows Updates Break Activation, Licensing and Printing Functions
Microsoft has acknowledged that its November 2024 cumulative updates are causing failures in Windows activation and licensing operations on multiple supported platforms. The Software Licensing Management Tool (SLMGR) returns error 0x80041008 when administrators run commands such as slmgr.vbs /skms-domain or slmgr.vbs /ipk, preventing product activation, KMS server configuration, and product key changes. The issue affects Windows 11 23H2, Windows 10 22H2, Windows 10 21H2, Windows Server 2025, Windows Server 2022, and Windows Server 2019. A separate regression introduced by the same updates prevents printing of documents that contain images with zero height or width, a technique used for watermarks in Microsoft Word and other applications. Microsoft stated that a fix will be released in the coming days and advised enterprise customers needing an immediate workaround to contact business support.
Fortinet Discloses Multiple Critical Vulnerabilities in FortiMail, All Addressed in October Update
Fortinet has published 24 security advisories detailing 27 vulnerabilities affecting its FortiMail email security product. Eight of the flaws received the highest severity rating of Critical, with three carrying a CVSSv3.1 base score of 9.8. The affected issues include path traversal CVE-2026-126147, command injection CVE-2026-126148, and SQL injection CVE-2026-126263, each capable of enabling arbitrary code execution. An additional unauthenticated SQL injection vulnerability tracked as CVE-2026-126164 scored 9.4, while four more flaws were rated 9.1. All issues were resolved in the October security update released by the vendor prior to the November 10 disclosure. No exploitation of the vulnerabilities has been observed in the wild at the time of advisory publication.