node 26.13.1 released

Highlights include:

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High

Earlier coverage

• Ethersphere releases bee-js 13.3.0, Swarm Desktop 0.56.2 with wallet-stealing malware Nov 9
• Cloudflare Develops Public Certificate Authority for Post-Quantum Web Security Nov 9
• Deno security model critique published in 2024 Nov 7