Node.js fixes 16 security vulnerabilities including HTTP/2 flaws

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Node.js servers using built-in HTTP/2 on 24.x and 26.x

Tier B because: Core infrastructure or popular tool AND remote, no login

Reach

Attack

Damage

Fix

Popular tool · Remote, no login

What to do

The Brief

Node.js released security updates fixing 16 vulnerabilities in its HTTP/2, HTTPS and TLS components.
Seven of the issues are rated high severity, including memory disclosures and crash risks.
An unauthenticated client can crash servers using built-in HTTP/2 on the 24.x and 26.x lines, and another HTTP/2 flaw can leak server memory, including responses meant for other connections.

Node.js servers that use built-in HTTP/2, HTTPS or TLS can be crashed or can leak data from other clients until they are upgraded.

Checklist · 3 of 10 yes

Yes	Hits tech teams	Node.js runtime is built with and run by developers and ops teams.
No	Core infrastructure	Node.js is a widely used runtime but is not in the core infrastructure list like OpenSSH or the Linux kernel.
Yes	Popular tool	Node.js is a mainstream developer platform used by many teams.
No	Exploited in the wild	Sources describe the flaws as fixed vulnerabilities; neither reports observed attacks.
No	Public exploit	Neither source says exploit code or a proof-of-concept is published.
Yes	Remote, no login	The Hacker News: unauthenticated clients can crash servers using built-in HTTP/2 support.
No	Full takeover	Sources describe crashes and memory disclosure only, not code execution or admin takeover.
No	Secrets exposed	The Hacker News says a flaw could leak other connections' data, but no actual exposure is reported.
No	Supply chain	Sources describe ordinary vulnerabilities in legitimate Node.js code, not a compromised channel.
No	No fix yet	DEV Community: fixes are available in versions 22.23.5, 24.22.3, and 26.13.1.

First seen 3h ago · 2 sources · Full story page · How tiers are decided