The Node.js project has released security updates that fix 16 vulnerabilities in the runtime, seven of them rated high, The Hacker News reports. The fixes are in 22.23.5, 24.22.3 and 26.13.1. If you run Node.js as an HTTP/2, HTTPS or TLS server, this is a patch day, not a “maybe later.”
Several of the high-severity issues affect the built-in HTTP/2 support. On the 24.x and 26.x lines, an unauthenticated client can crash some default HTTP/2 servers. A separate HTTP/2 flaw can cause a server to send a client pieces of memory, including responses meant for other connections, and it affects all three supported lines. Other high-severity fixes cover memory and file-descriptor leaks on HTTP/2, memory corruption when serving files over HTTP/2 on 24.x and 26.x, crashes in some TLS-server hooks, and a TLS 1.2 renegotiation issue around stricter client-certificate rules. A high-severity HTTPS-server bug can also let an unauthenticated client read memory from other connections, including material you never want leaving the process. Plain node:http servers aren’t in that last bucket.
The project’s advisory says updating to the fixed version for your line is the only fix, with no workaround listed for servers that can’t move yet. End-of-life lines, including 20.x and 25.x, don’t get a fix in this release.
Review before you install: read the release notes yourself, back up your config, and try new versions somewhere you can afford to break first.
My take
If you ship anything that speaks HTTP/2 or TLS through Node itself, get onto 22.23.5, 24.22.3 or 26.13.1. Don’t wait for a quiet maintenance window that never comes. And if you’re still on an EOL line, this is your reminder that “we’ll upgrade later” now means “there is no patch.”
God Bless, and May the Source Be with You!
