Node.js has delivered version 26.13.1 (LTS) to address high-severity security vulnerabilities across its HTTP/2 and TLS subsystems. The release mitigates multiple risks by stopping unauthorized SNI modifications during handshakes, eliminating TLS server crash vectors, and properly freeing resources for abandoned streams. Furthermore, the update remedies medium and low-priority issues like recursive file watching permission leaks while refreshing several core dependencies including SQLite and llhttp.
Key points
Deploying this update remediates critical networking vulnerabilities that otherwise allow…: Deploying this update remediates critical networking vulnerabilities that otherwise allow remote crashes and protocol manipulation.
Mutual TLS connections without a session ID context will no longer support session resump…: Mutual TLS connections without a session ID context will no longer support session resumption to improve overall security.
Infrastructure teams benefit from build-level improvements that ensure compatibility with…: Infrastructure teams benefit from build-level improvements that ensure compatibility with older OpenSSL 3.0 implementations and enforce API levels.
Sources checked by our analysis pipeline: 1
Antoine du Hamel
2026-11-11, Version 26.13.1 'Lithium' (LTS), @aduh95
This is a security release.
Notable Changes
- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
- (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
Cultural organizations are accelerating digital preservation initiatives to make historic archives and Indigenous films accessible to wider international audiences. Concurrently, the technology sector is dealing with critical infrastructure updates and software security vulnerabilities across major platforms. Meanwhile, social media operators face mounting scrutiny over algorithmic harms and content moderation failures that expose users to safety risks.
Developer Bo Lau has launched an interactive project titled "Term Sheet, Please" that reimagines venture capital screening through document-inspection simulation mechanics. Set immediately in the wake of Demo Day, the narrative-driven game casts players as investors scrutinizing applicant materials to make high-stakes financial calls. This simulation gamifies the startup evaluation process by requiring users to conduct due diligence directly from an office desk.
Tech leaders who sought common ground with Donald Trump now find themselves in a precarious position across multiple political and competitive fronts. Retaliatory measures from Democrats loom as a significant threat, even as public skepticism toward major technology platforms intensifies nationwide. These domestic political vulnerabilities are compounding international risks, particularly as foreign rivals challenge American dominance in emerging software sectors.