Claude autonomously finds and chains 3 Node.js CVEs, prompting emergency security releases
chrisrohlf · x · 2026-11-12
Anthropic researcher Chris Rohlf reports that Claude was able to autonomously discover, chain, and remotely exploit three Node.js vulnerabilities: CVE-2026-123864, CVE-2026-123866 (another bug collision), and CVE-2026-123874. The first two are remote memory disclosures; the third can achieve RCE but requires the app to use stream.respondWithFile/FD. He urges developers to patch Node.js deployments this week.
Node.js has shipped security releases for the 26.x, 24.x, and 22.x lines, addressing dependency vulnerabilities:
- HTTP/2 remote abort (CVE-2026-123863, high): a reachable assertion in Http2Session teardown lets any unauthenticated client crash the server over TLS or cleartext, affecting 24.x/26.x. Node.js credits Chris Rohlf in collaboration with Claude and Anthropic Research for reporting it.
- HTTPS memory disclosure (CVE-2026-123864, high): an llhttp re-entrancy flaw lets an unauthenticated client read memory from other connections.
- Additional fixes cover undici (24.x/26.x) and sqlite (22.x/24.x).
More from Models
- Ricursive releases open-weight Ripple-65B, claiming US open-weight SOTA on TerminalBench 2.1 — StanfordAILab · 2026-11-12
- A criminally underrated resource comparing tool-calling reliability across models and providers — ricklamers · 2026-11-12
- Datalab fast-mode OCR beats Opus 5.5 and GPT-6.1 Sol at 1/4 to 1/68 the price — VikParuchuri · 2026-11-12
- Claude's world knowledge impresses: model guesses user identity from one prompt — adonis_singh · 2026-11-12
- Gemini 4 Carbon opens to all at $2/$10, price doubling to $4/$20 on Dec 1 — socialwithaayan · 2026-11-12
- Ten wild Gemini 4 Carbon demos in 24 hours: CUDA meadows, V8 engines, mech stomps — socialwithaayan · 2026-11-12