Node.js Just Patched 11 CVEs Across All Three Active Release Lines, Two Days Late. Here's the 15-Minute Patch You Actually Need to Run.
Node.js shipped its July 2026 security release on Wednesday, July 29, two days later than planned, after the project pushed the date back twice for infrastructure and testing issues. The release patches 11 CVEs simultaneously across all three active lines: v22.23.2, v24.18.1, and v26.5.1. Three are High severity, including an HTTP/2 heap-use-after-free and a Permission Model flaw that over-grants filesystem access. If you run anything under Node's --permission sandbox (which increasingly means anyone sandboxing an AI coding agent), this is the release to stop and check, not the one to file under "eventually."
What actually got patched
The two High-severity HTTP/2 bugs are worth understanding on their own. CVE-2026-56846 lets retained header blocks bypass the maxSessionMemory limit, so an attacker can remotely trigger uncontrolled memory consumption, a denial-of-service vector that doesn't require anything exotic, just a session that keeps growing past the limit that's supposed to stop it. CVE-2026-56848 is a re-entrant call bug: nghttp2_session_mem_send() can get called while nghttp2_session_mem_recv() is still executing, producing a heap-use-after-free. Both affect every active release line.
The third High-severity fix, CVE-2026-58043, is a Permission Model flaw where path matching over-grants filesystem access across radix-tree prefix boundaries. Under --permission, if you've granted access to one path, this bug lets that access be abused to read or write paths outside the intended allowlist. This one matters more than its single CVE number suggests, because it's not isolated: this release also patches CVE-2026-56847 (Low), where trace_events.createTracing().enable() can write trace logs outside --allow-fs-write paths, and CVE-2026-58039 (Low), where process.report can write and overwrite files outside the same allowlist. Three separate, independently discovered ways to walk around the same sandbox boundary, patched in the same release.
The remaining fixes cover a spread of subsystems: an HTTPS Agent bug (CVE-2026-56850) that lets mTLS client identities get reused across requests configured with different certificates, due to PFX object-array key collisions; an incomplete fix for an earlier hostname-verification bypass (CVE-2026-58040, following up on CVE-2026-48934); a node:sqlite bug (CVE-2026-58041) where a stale StatementSyncIterator can re-execute a cached prepared statement after it's been reset and rebound with new parameters; a dns.resolveAny() crash (CVE-2026-58042) triggered by DNS responses with more than 256 A records; a node:zlib crash (CVE-2026-58045) from a spoofed TypedArray byte length; and an HTTP parser bug (CVE-2026-58044) where headers beyond maxHeadersCount get silently dropped from req.headers while still being used internally for message framing, enabling request smuggling against forwarding proxies that rebuild outbound headers from what they can see.
Why the Permission Model bugs are the ones to actually care about
Node's --permission flag exists specifically so you can run code you don't fully trust (third-party scripts, generated code, an AI agent's output) inside boundaries you define, restricting filesystem and network access to an explicit allowlist. That's exactly the tool a growing number of solo developers reach for when they let a coding agent run somewhat autonomously: sandbox it, give it write access to the project directory and nothing else, let it work.
This release patches three independent bugs that all break that boundary in different ways: one High-severity path-matching flaw and two Low-severity write bypasses via tracing and process reporting. None of these are exotic attack chains; they're the kind of thing that gets found once someone actually goes looking at how the enforcement works under the hood. If your mental model of --permission was "the agent can only touch what I allowed," this release is a reminder that the sandbox has had more gaps than advertised, and that those gaps get found and fixed one at a time rather than all at once.
The 15-minute checklist
Check which Node major you're running in production and in your local dev environment: 22.x, 24.x, or 26.x. All three lines needed patching, so "I'm on the LTS line" doesn't mean you were unaffected. Upgrade to v22.23.2, v24.18.1, or v26.5.1 depending on which line you track.
If you run anything under --permission (sandboxing an AI coding agent, running untrusted user-submitted code, isolating a plugin system), treat this upgrade as non-optional this week. The combination of one High-severity and two Low-severity Permission Model bypasses, all in the same release, is a stronger signal than a single isolated CVE would be: it suggests the boundary has had more soft spots than any one report captures, and patching one release behind means running with known bypasses in a mechanism you're specifically relying on for isolation.
If you run Node behind a forwarding proxy that reconstructs headers from IncomingMessage, check whether CVE-2026-58044 applies to your setup: the request-smuggling vector here specifically targets proxies that rebuild outbound headers from visible headers while piping the original body through a reused backend connection. That's a common enough proxy pattern that it's worth five minutes to confirm you're not exposed.
The honest take
This isn't a novel attack story, and none of these CVEs made headlines the way a supply-chain worm or a zero-day exploited in the wild does. That's actually the point. The discipline this blog keeps coming back to with Node, npm, and the rest of the JS toolchain is boring on purpose: patch on the release, don't wait for a reason to feel urgent about it. The reason this particular release earns a "stop what you're doing" reaction rather than a "patch it next sprint" one is narrow and specific: if you're using --permission to sandbox an AI agent, three of these eleven CVEs are directly about that sandbox leaking, and that's the one scenario where a two-week delay isn't a rounding error.
If you don't run anything under --permission and you're not behind a proxy pattern vulnerable to CVE-2026-58044, this is still worth doing this week rather than next, but it's a normal patch cycle, not a five-alarm fire. Know which category you're in before you decide how urgently to act.
Author
Lukas
@lukcombinator