Node.js Ships 16 Fixes, Two HTTP/2 and HTTPS Flaws Can Crash Servers or Leak Memory

Servers still on end-of-life lines get no patch, and operators on supported lines must upgrade to close the exposure.

Node.js has shipped fixes for 16 vulnerabilities across its supported 22.x, 24.x and 26.x lines, with eight of the flaws sitting in its own HTTP/2, HTTPS and TLS server code. The most serious include a remote crash on default HTTP/2 servers that respond before the request body finishes arriving, and a memory disclosure that can expose TLS private keys and other users' requests when a handler flushes headers early and later echoes or stores request bodies. Patched releases are 22.23.5, 24.22.3 and 26.13.1, and upgrading is the only remedy listed, since no workaround is given for servers that cannot yet update. End-of-life lines such as 20.x and 25.x receive no patch and are considered vulnerable. The advisory reports no exploitation in the wild and does not say whether operators should rotate keys after patching.