Ethical Hacking News
Node.js has released a critical patch to address 16 vulnerabilities, including HTTP/2 bugs that can cause servers to crash or leak sensitive data from other connections. The patch includes fixes for five high-rated vulnerabilities and is recommended for all supported lines. Server administrators should prioritize updating their systems to the latest supported versions to prevent potential security breaches.
16 vulnerabilities were addressed in the recent Node.js patch release, with 5 rated high. Fixes were included for HTTP/2 bugs that can cause servers to crash or leak sensitive data. Affects lines 22.23.5, 24.22.3, and 26.13.1, and has a default HTTP/2 server response before the request body arrives. Fixes also addressed an HTTPS server flaw allowing unauthenticated clients to read memory from other connections. Vulnerabilities are located in the runtime's HTTP/2, HTTPS, and TLS server code. Server administrators should update to supported lines (e.g. 22.23.5, 24.22.3, and 26.13.1) as versions 20.x and 25.x are no longer supported. No reports of attacks using these vulnerabilities, but proactive measures are necessary to prevent potential exploitation.
A recent patch release by the Node.js team has addressed 16 vulnerabilities in the runtime, with five of them being rated high. The release includes fixes for HTTP/2 bugs that can cause servers to crash or leak sensitive data from other connections. These vulnerabilities were identified through collaborative efforts with security researchers, including Chris Rohlf, Claude, and Anthropic Research.
The patched release, which includes fixes for lines 22.23.5, 24.22.3, and 26.13.1, aims to prevent unauthenticated clients from crashing servers that use the built-in HTTP/2 support. The HTTP/2 bug, CVE-2026-123863, requires only a default HTTP/2 server that replies before the request body has fully arrived. The bug can work over both TLS and cleartext connections, making it a significant concern for server administrators.
Furthermore, the patch release addresses a separate HTTP/2 flaw, CVE-2026-123866, which can cause servers to send pieces of their memory, including responses intended for other connections, to unauthenticated clients. This vulnerability affects all three supported lines and can be triggered by clients alone. The patched release also includes fixes for an HTTPS server flaw, CVE-2026-123864, which allows unauthenticated clients to read memory from other connections, including TLS private keys and other users' requests.
The vulnerabilities patched in the latest Node.js release are rated high and are located in the runtime's HTTP/2, HTTPS, and TLS server code. This means that only updating to the fixed version for each line is the recommended fix, as there are no workarounds for servers that cannot update yet.
The Node.js team notes that versions 20.x and 25.x are no longer supported and do not receive any fixes in this release. These versions are considered end-of-life, and server administrators are advised to update to supported lines, such as 22.23.5, 24.22.3, and 26.13.1.
The vulnerabilities patched in the latest Node.js release were reported by Chris Rohlf in collaboration with Claude and Anthropic Research. The Node.js team emphasizes that there have been no reports of attacks using these vulnerabilities, but it is essential for server administrators to take proactive measures to update their systems and prevent potential exploitation.
In light of this patch release, it is crucial for server administrators to prioritize updating their Node.js systems to the latest supported versions. This will help prevent potential security breaches and minimize the risk of data leakage or server crashes. By staying up-to-date with the latest security patches, organizations can ensure the security and integrity of their systems.
Related Information:
https://www.ethicalhackingnews.com/articles/Nodejs-Patch-Release-Fixes-16-Vulnerabilities-Including-HTTP2-Bugs-That-Crash-Servers-and-Leak-Connections-Data-ehn.shtml
https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html
https://nvd.nist.gov/vuln/detail/CVE-2026-123863
https://www.cvedetails.com/cve/CVE-2026-123863/
https://nvd.nist.gov/vuln/detail/CVE-2026-123864
https://www.cvedetails.com/cve/CVE-2026-123864/
https://nvd.nist.gov/vuln/detail/CVE-2026-123866
https://www.cvedetails.com/cve/CVE-2026-123866/
Published: Thu Nov 12 03:32:53 2026 by llama3.2 3B Q4_K_M
