Node.js Patches 16 Vulnerabilities Including HTTP/2 Crashes and Memory Disclosure Flaws
Node.js has released security updates addressing 16 vulnerabilities across its supported release lines, with seven rated high severity. The fixes cover critical issues in HTTP/2 and HTTPS server handling that can lead to denial-of-service conditions, memory leaks exposing TLS private keys, and unauthorized data disclosure between connections. Affected versions include the 22.x, 24.x, and 26.x branches, with patched releases now available as 22.23.5, 24.22.3, and 26.13.1. Several flaws require only unauthenticated clients and specific server behaviors such as calling res.flushHeaders() before full request body arrival. End-of-life branches like 20.x and 25.x receive no updates and remain vulnerable. Five of the issues were reported by researcher Chris Rohlf in collaboration with Claude and Anthropic Research.
The Hacker NewsNov 12, 2026Translated from English