A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections. Fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1.
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Re: Node.js security release pre-alert
Posted by Antoine du Hamel on Nov 11 Releases are out, more info at https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
Node.js security release pre-alert
Posted by Antoine du Hamel on Nov 04 We will release new versions of Node.js 22, 24, and 26 release lines on or shortly after 2026-11-11 in order to address security…
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
Re: Upcoming Node.js security release 2026/10/21
Posted by Michael Orlitzky on Oct 24 Only those dumb enough to bundle or statically link their dependencies. The bare minimum in terms of software engineering would…
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli…
The internet is having a very bad cybersecurity day
From AI-discovered PHP vulnerabilities to flaws in Node.js and popular AI tool LiteLLM, cybersecurity teams have plenty to worry about this week.