Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

Node.js has addressed 16 vulnerabilities, including issues related to its HTTP/2 support. A flaw in the 24.x and 26.x release lines allows unauthenticated clients to crash servers using the built-in HTTP/2 support. Another HTTP/2 flaw can cause servers to leak sensitive data, including responses intended for other connections, by sending pieces of their memory to clients. Fixed versions of Node.js have been released for all three supported lines. The updated versions are 22.23.5, 24.22.3, and 26.13.1. These fixes address the identified security issues, including the potential for server crashes and data leaks.