CVE-2026-123864 in Node.js

CVE record (and related): CVE-2026-123864, CVE-2026-123863, CVE-2026-123865, CVE-2026-123866, CVE-2026-126051, CVE-2026-123872, CVE-2026-123874, CVE-2026-123828, CVE-2026-123867, CVE-2026-123868, CVE-2026-123871, CVE-2026-123877, CVE-2026-123875, CVE-2026-123829, CVE-2026-123862, CVE-2026-106071

Impact on Access Server: None.

Details:

OpenVPN Access Server uses Node.js during the frontend build process but doesn't include Node.js or its vulnerable components at runtime. Access Server uses the Twisted web server instead of Node.js to handle web traffic.

Most of these Node.js-specific vulnerabilities, including those classified as high severity, affect the native HTTP/2, HTTPS, and TLS server implementations in Node.js. These vulnerabilities involve components such as llhttp, nghttp2, and core TLS wrapper modules.

These vulnerabilities pose a threat when a Node.js process runs as a server and directly handles network connections from untrusted clients, such as incoming HTTP/2 streams, TLS handshakes, or client certificates.

The remaining Node.js vulnerabilities affect other components that aren't relevant to Access Server because Node.js isn't included or used at runtime.

We've updated our build systems to the latest versions to help maintain a secure build environment.

Remediation:

Since the vulnerable Node.js files are not in OpenVPN Access Server, no remediation steps are required.

Need help?

If you have questions, submit a support ticket.