Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

news

The Hacker News

November 12th, 2026 at 8:20 AM

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections. Fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1. The crash

#product

Open source

Get stories like this every Monday

The week's most important AI news in one email. Free, unsubscribe anytime.

Score: 2.51

Engagement proxy: 0

Canonical link: https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html