[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f12m5mBkgqY8r_CvPH6mjU9LfThEn_CI-Fkqy4I3_E9k":3},{"article":4,"iocs":38,"watch_terms":70,"solutions":71,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"acb33308-30aa-4822-a0b0-e05adf603059","Node.js Security Update Fixes 16 Flaws, 7 High-Severity","node-js-security-update-fixes-16-flaws-7-high-severity-565e23","Node.js 26.13.1, 24.22.3 and 22.23.5 fix seven High-rated HTTP\u002F2 and TLS flaws that unauthenticated clients can trigger.","Node.js has released security updates for its 26.x, 24.x, and 22.x lines, fixing a total of 16 vulnerabilities. Seven of these are rated High, six Medium, and three Low. The High-severity flaws primarily affect HTTP\u002F2 and TLS server code, with several exploitable by unauthenticated remote clients. One critical flaw, CVE-2026-123864, allows an unauthenticated client to read memory from other connections, potentially including TLS private keys, due to a re-entrancy bug in TLS write handling.","Node.js security updates address 16 vulnerabilities, including 7 high-severity flaws in HTTP\u002F2 and TLS.","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F11\u002Fnodejs-november-2026-security-update-16-cves.html","https:\u002F\u002Fwww.cyberkendra.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fnodejs-update.webp","2026-11-11T18:08:01+00:00","2026-11-11T19:00:17.876482+00:00",8,[17],{"name":18,"type":19},"Node.js","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":20,"icon":22,"name":23,"slug":24},null,"Vulnerabilities","vulnerabilities",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39,43,46,49,52,55,58,61,64,67],{"type":40,"value":41,"context":42},"cve","CVE-2026-123864","High-severity HTTPS memory leak vulnerability",{"type":40,"value":44,"context":45},"CVE-2026-111497","Brotli decoder flaw fixed in prior release",{"type":40,"value":47,"context":48},"CVE-2026-123863","HTTP\u002F2 server crash vulnerability",{"type":40,"value":50,"context":51},"CVE-2024-27983","Related to HTTP\u002F2 server crash vulnerability",{"type":40,"value":53,"context":54},"CVE-2026-123866","Vulnerability allowing freed response memory to be sent to a peer",{"type":40,"value":56,"context":57},"CVE-2026-123874","Vulnerability allowing unauthenticated client to corrupt server memory",{"type":40,"value":59,"context":60},"CVE-2026-48937","Related to protocol error during shutdown vulnerability",{"type":40,"value":62,"context":63},"CVE-2026-123865","Protocol error during shutdown vulnerability",{"type":40,"value":65,"context":66},"CVE-2026-123872","TLS renegotiation vulnerability",{"type":40,"value":68,"context":69},"CVE-2026-126051","TLS server crash vulnerability",[18],{"controls":72,"vendors":156},[73,102,127],{"slug":74,"name":75,"problem":76,"products":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":103,"name":104,"problem":105,"products":106},"patch-management","Automated patch management","Known holes get closed in days, not months.",[107,115,119],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":103,"product_name":116,"url":117,"description":118},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":128,"name":129,"problem":130,"products":131},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[132,140,148],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[],{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":167},"nodejs-patches-16-flaws-including-memory-leak-exploitable-by-unauthenticated-clients","Node.js Patches 16 Flaws Including Memory Leak Exploitable by Unauthenticated Clients","Node.js released security updates across three active release lines to address 16 vulnerabilities, seven of which are rated High severity. The most critical flaw, CVE-2026-123864, stems from a re-entrancy bug in TLS write handling that allows an unauthenticated remote client to read memory from other connections — potentially exposing TLS private keys. This matters because Node.js is embedded in countless production applications and APIs, making delayed patching a widespread risk. Organizations running unpatched Node.js instances on internet-facing services are exposed to passive key theft and connection data leakage without any authentication requirement.",[162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(e)":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management (v8)":171,"CIS Control 2: Inventory and Control of Software Assets (v8)":172},"This point requires security in acquisition, development and maintenance including vulnerability handling, which covers the obligation to apply vendor-issued patches for known vulnerabilities in runtime components like Node.js.","SI-2 requires organizations to identify, report, and correct information system flaws, and to install security-relevant updates within defined timeframes — exactly the response needed for these Node.js patches.","Running unpatched Node.js versions with known High-severity flaws is a direct instance of using vulnerable components, the risk class this OWASP category addresses.","This control requires organizations to track and remediate vulnerabilities in a risk-prioritized, timely manner — directly applicable to acting on Node.js's disclosure of seven High-severity flaws.","Knowing which Node.js versions are deployed across the environment is a prerequisite for identifying exposure and prioritizing patching when a security advisory is released."]