The short answer
Run node -v. The Node.js security release of 11 November 2026 fixes 16 vulnerabilities, 7 rated high, in 26.13.1, 24.22.3 and 22.23.5. If yours is older on the 26, 24 or 22 line, update it with the tool that installed it, such as brew upgrade node or nvm install 24.22.3, then restart running Node servers.
On this page
What the release fixes
| CVE | What it is |
|---|---|
| CVE-2026-123863 | HTTP/2: a remote peer can abort the process when a session is torn down. |
| CVE-2026-123864 | HTTPS: a zero-length TLS write can make the server copy its own memory into a request body. |
| CVE-2026-123865 | HTTP/2 sessions are never cleaned up if a protocol error happens while the connection shuts down. |
| CVE-2026-123866 | HTTP/2 stream teardown can send freed response memory to the peer. |
| CVE-2026-126051 | TLS servers can be made to throw an uncaught exception remotely through deferred handshake callbacks. |
| CVE-2026-123872 | TLS 1.2 renegotiation lets a client change the server name and get past client certificate authentication. |
| CVE-2026-123874 | HTTP/2: use-after-free when a respondWithFile() stream is reset during a pending write. |
CVE-2026-123863
- What it is
- HTTP/2: a remote peer can abort the process when a session is torn down.
CVE-2026-123864
- What it is
- HTTPS: a zero-length TLS write can make the server copy its own memory into a request body.
CVE-2026-123865
- What it is
- HTTP/2 sessions are never cleaned up if a protocol error happens while the connection shuts down.
CVE-2026-123866
- What it is
- HTTP/2 stream teardown can send freed response memory to the peer.
CVE-2026-126051
- What it is
- TLS servers can be made to throw an uncaught exception remotely through deferred handshake callbacks.
CVE-2026-123872
- What it is
- TLS 1.2 renegotiation lets a client change the server name and get past client certificate authentication.
CVE-2026-123874
- What it is
- HTTP/2: use-after-free when a
respondWithFile()stream is reset during a pending write.
The other nine are rated medium or low. They include a heap buffer overflow in session.altsvc(), proxy credentials shown in ERR_PROXY_INVALID_CONFIG error messages, certificate checks skipped through TLS session reuse in https.Agent, and three Permission Model and zlib issues. The fixed versions are 26.13.1, 24.22.3 and 22.23.5. They come after the October release, so they include its fixes too.
Check your version, and where Node came from
- Open Terminal (Applications › Utilities › Terminal).
- Run
node -v. Compare it with the fixed version for its line: 26.13.1, 24.22.3 or 22.23.5. - Run
which -a nodeto list every Node on your PATH. The first line is the one Terminal runs. - Run
nvm ls,fnm list,volta list node,mise ls nodeorbrew list --versions | grep -E "^node"for the version managers you use. They keep other copies thatwhichdoesn't show.
node -v
which -a node| Path contains | Installed by |
|---|---|
/opt/homebrew/ | Homebrew |
.nvm | nvm |
.volta | Volta |
fnm | fnm |
mise | mise |
.asdf | asdf |
/usr/local/bin/node | Usually the installer from nodejs.org |
/opt/homebrew/- Installed by
- Homebrew
.nvm- Installed by
- nvm
.volta- Installed by
- Volta
fnm- Installed by
- fnm
mise- Installed by
- mise
.asdf- Installed by
- asdf
/usr/local/bin/node- Installed by
- Usually the installer from nodejs.org
Update Node with the tool that installed it
The examples use 24.22.3. For the 26 line use 26.13.1, and for the 22 line use 22.23.5.
Homebrew
brew update
brew upgrade nodeFor a versioned formula, name it: brew upgrade node@22. If node -v still shows the old version afterwards, Homebrew may not have published the new build yet. Run brew update and try again later.
nvm
nvm install 24.22.3 --reinstall-packages-from=current
nvm alias default 24.22.3--reinstall-packages-from=current copies your global npm packages from the version you're on. nvm alias default makes new Terminal windows use the new version.
Volta
volta install node@24.22.3For a project that pins Node in package.json, run volta pin node@24.22.3 in its folder.
fnm
fnm install 24.22.3
fnm default 24.22.3mise or asdf
mise use -g node@24.22.3asdf install nodejs 24.22.3
asdf set -u nodejs 24.22.3
# asdf older than 0.16
asdf global nodejs 24.22.3The installer from nodejs.org
- Download the macOS Installer (.pkg) for 26.13.1, 24.22.3 or 22.23.5 from nodejs.org.
- Open the downloaded .pkg and follow the installer. It replaces the version in
/usr/local/bin. - Open a new Terminal window and run
node -vto confirm the version.
After updating
- Restart running Node processes. Servers, dev servers and watchers started before the update keep the old version until they restart. Most of these fixes are in HTTP/2 and TLS servers, so restart those first.
- Update project pins.
.nvmrc,.node-version,.tool-versionsand thevoltafield inpackage.jsonchoose a version per project, so change them to the fixed version. - Check every version you keep. Run step 4 of the check above again. An old copy that a project still picks runs with the old code.