node 26.13.1 released

Highlights include:

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High

Earlier coverage

• Chrome zero-day whack-a-mole continues as 2026 tally hits 8 Nov 10
• Google patches eighth Chrome zero-day exploited in attacks this year Nov 10
• Malware Steals Wallet Keys via Compromised Ethersphere bee-js 13.3.0, Swarm Desktop 0.56.2 Nov 9