Node.js June 2026 Security Release: 12 CVEs Patched, Including Two Auth Bypasses

Node.js pushed security updates on June 18, 2026 for all three active release lines. The advisory covers 12 CVEs across v22, v24, and v26, with two rated high severity and one rated critical. If you run Node.js in production, check your version now.

node --version

The fixed versions are v22.23.0, v24.17.0, and v26.3.1. If you’re below any of those, read on.

The undici HTTP response queue poisoning (CVE-2026-6733)

This one is architecturally the most interesting, and it matters for any code that makes HTTP/1.1 requests via undici, including Node.js’s built-in fetch.

HTTP/1.1 keep-alive lets a single TCP connection be reused across multiple request/response cycles. The client sends a request, the server responds, and the connection sits idle until the next request. The protocol relies on strict ordering: one response per request, in order.

The flaw: if an attacker controls the server (or sits between the client and server), they can push an extra, unsolicited HTTP response onto an idle keep-alive socket after the client’s last request completes. When the client sends its next request on that socket, undici matches the injected response to the new request. The wrong caller gets the wrong response.

Why this matters in practice:

• An application makes a request to check user permissions, expecting a {"allowed": true} or {"allowed": false} response.
• An attacker who controls the server (or the network path) injects a {"allowed": true} response ahead of the actual permission check.
• The application authorizes an action it should have rejected.

The attack requires either a controlled server or a man-in-the-middle position. It is not exploitable purely from the client side. But it is the class of vulnerability that matters when connecting to third-party APIs or traversing networks where TLS termination happens before your application code.

The fix for standalone undici (npm package):

npm install undici@latest
# or pin to a safe version
npm install undici@^6.27.0  # for the v6 line
npm install undici@^7.28.0  # for the v7 line
npm install undici@^8.5.0   # for the v8 line

The fix for Node.js built-in fetch: Update Node.js itself. The bundled undici in Node.js is separate from your node_modules/undici. Updating the npm package does not patch fetch. You need v22.23.0, v24.17.0, or v26.3.1.

Temporary mitigation if you cannot update immediately:

import { Client } from "undici";

// Disable keep-alive connection reuse to remove the attack surface
const client = new Client("https://api.example.com", {
  keepAliveTimeout: 0,
});

Note: disabling keep-alive increases latency and connection overhead. It is a mitigation, not a fix.

The two high-severity authentication bypasses

The advisory describes two high-severity vulnerabilities in the authentication layer. Node.js’s security release policy does not publish full technical details until patches are widely deployed, so the specifics are limited at this stage.

What is known: both affect the authentication handling in the HTTP client and server. They are reachable from the network. The advisory does not indicate active exploitation in the wild for these two, unlike some CVEs that arrive with exploit code.

The practical guidance is the same regardless: update to the fixed release. These are rated high severity for a reason.

CVE-2026-22036: unbounded decompression via Content-Encoding

HTTP responses can be compressed, and Content-Encoding headers tell the receiver how to decompress them. A single response can use multiple encoding layers: Content-Encoding: gzip, br means the body is brotli-compressed inside gzip.

CVE-2026-22036 is a resource exhaustion flaw in how Node.js handles chained encoding. There is no cap on how many decompression layers are processed, and no limit on the total decompressed size. An attacker sends a small response body with deeply nested compression layers. Node.js decompresses each layer in sequence, expanding the data exponentially. Memory is exhausted.

This is reachable from HTTP servers too: a client that connects to your Node.js server and sends a request body with chained content encoding can trigger the same expansion on the receiving end.

// When you process incoming requests, avoid blindly decompressing
// arbitrary Content-Encoding chains. With the patched Node.js version,
// this is handled internally — but if you're on an unpatched version
// and can't update immediately, you can limit accepted encodings:

app.use((req, res, next) => {
  const encoding = req.headers["content-encoding"] || "";
  const layers = encoding.split(",").map(s => s.trim()).filter(Boolean);
  if (layers.length > 1) {
    return res.status(415).send("Chained content encoding not supported");
  }
  next();
});

This middleware-level check is a stopgap. The real fix is updating Node.js.

How to update

Node.js provides pre-built binaries, and most installation methods have a straightforward upgrade path:

# With nvm (most common for developer machines):
nvm install 26          # installs latest v26, currently v26.3.1
nvm use 26
nvm alias default 26    # make it the default

# Or pin a specific version:
nvm install 26.3.1
nvm use 26.3.1

# With fnm:
fnm install 26.3.1
fnm default 26.3.1

# Official installer (Linux):
# Download from https://nodejs.org/en/download/
# or use NodeSource packages for apt/yum
curl -fsSL https://deb.nodesource.com/setup_26.x | bash -
apt-get install -y nodejs

For container-based deployments, update the base image:

# FROM node:26
FROM node:26.3.1-slim
# (or 26.3.1-alpine, etc.)

Pinning to the specific patch version is safer than floating node:26 for production images.

What about the other 8 CVEs?

The June 18 advisory covers 12 CVEs total. Beyond the three discussed above, the remaining nine fall in the medium and low severity ranges. Node.js’s standard release policy patches everything in a batch to minimize the number of updates operators need to apply.

A useful habit: run npm audit after updating Node.js to check whether any npm packages your project depends on are also reporting advisories from this release cycle. The Node.js update patches the runtime; your node_modules dependencies are separate.

npm audit
npm audit fix       # auto-fix where safe
npm audit fix --force  # only if you understand the risk

Security in the Node.js ecosystem is layered. If you want a consistent framework for how this fits into a broader approach, the June 2026 Patch Tuesday post covers the parallel Microsoft and Splunk releases from the same week with similar triage logic.

Update to v22.23.0, v24.17.0, or v26.3.1. Check your undici version separately. Run npm audit. That covers the June cycle.