Blog
Insights on software development, security, and technology from our team.
Node.js patches 16 CVEs: HTTP/2 crashes and an HTTPS bug that leaks TLS keys
Node.js released 22.23.5, 24.22.3 and 26.13.1 on 11 November with fixes for 16 CVEs. The worst ones let a client with no credentials crash an HTTP/2 server or read other connections' memory, TLS private keys included. There's no workaround, so here's how we'd approach the upgrade.