Security · High impactFan score 43 · Tier B2 sources

Urgent update for Node.js: 16 security vulnerabilities fixed

DEV · By Hacks.gr · 3h ago

The Brief · written from 2 sources

Node.js released security updates fixing 16 vulnerabilities in its HTTP/2, HTTPS and TLS components.
Seven of the issues are rated high severity, including memory disclosures and crash risks.
An unauthenticated client can crash servers using built-in HTTP/2 on the 24.x and 26.x lines, and another HTTP/2 flaw can leak server memory, including responses meant for other connections.

Why it matters

Node.js servers that use built-in HTTP/2, HTTPS or TLS can be crashed or can leak data from other clients until they are upgraded.

Who’s affected

Node.js teams running built-in HTTP/2 on 24.x or 26.x
Node.js servers using HTTPS or TLS

What to do

Upgrade to Node.js 22.23.5, 24.22.3 or 26.13.1, matching your release line

Node.js 22.23.5
Node.js 24.22.3
Node.js 26.13.1
#nodejs
#http2
#tls
#vulnerability
#security
#memory-disclosure

Node.js has released security updates addressing 16 vulnerabilities in its HTTP/2, HTTPS, and TLS components. Seven issues are rated high severity, including memory disclosures and crash risks. Fixes are available in versions 22.23.5, 24.22.3, and 26.13.1. What problems were…

Read the full story at dev.to ↗