Security · High impactFan score 43 · Tier B2 sources
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
The Hacker News ·
The Brief · written from 2 sources
- Node.js released security updates fixing 16 vulnerabilities in its HTTP/2, HTTPS and TLS components.
- Seven of the issues are rated high severity, including memory disclosures and crash risks.
- An unauthenticated client can crash servers using built-in HTTP/2 on the 24.x and 26.x lines, and another HTTP/2 flaw can leak server memory, including responses meant for other connections.
Why it matters
Node.js servers that use built-in HTTP/2, HTTPS or TLS can be crashed or can leak data from other clients until they are upgraded.
Who’s affected
- Node.js teams running built-in HTTP/2 on 24.x or 26.x
- Node.js servers using HTTPS or TLS
What to do
- Upgrade to Node.js 22.23.5, 24.22.3 or 26.13.1, matching your release line
- Node.js 22.23.5
- Node.js 24.22.3
- Node.js 26.13.1
- #nodejs
- #http2
- #tls
- #vulnerability
- #security
- #memory-disclosure
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other…
Timeline
Full coverage · 2 sources
- 2h ago ↗
DEV Community: backend
Urgent update for Node.js: 16 security vulnerabilities fixed - 3h ago ↗
The Hacker News
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data