# Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

Source: [The Hacker News](https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html) · 2026-11-12 · Security
Page: https://themorning.dev/story/node-js-fixes-16-flaws-including-http-2-bugs-that-crash-servers-and-leak-other-c-c2d283cd7530758c
Kind: security · Impact: high

## In brief

- Node.js released security updates fixing 16 vulnerabilities in its HTTP/2, HTTPS and TLS components.
- Seven of the issues are rated high severity, including memory disclosures and crash risks.
- An unauthenticated client can crash servers using built-in HTTP/2 on the 24.x and 26.x lines, and another HTTP/2 flaw can leak server memory, including responses meant for other connections.

## Why it matters

Node.js servers that use built-in HTTP/2, HTTPS or TLS can be crashed or can leak data from other clients until they are upgraded.

## What to do

- Upgrade to Node.js 22.23.5, 24.22.3 or 26.13.1, matching your release line

## Versions

- Node.js 22.23.5
- Node.js 24.22.3
- Node.js 26.13.1

## Coverage

- [Urgent update for Node.js: 16 security vulnerabilities fixed](https://dev.to/hacksgr/urgent-update-for-nodejs-16-security-vulnerabilities-fixed-4m80) — DEV Community: backend, 2026-11-12
- [Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data](https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html) — The Hacker News, 2026-11-12

Tags: nodejs, http2, tls, vulnerability, security, memory-disclosure

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev