Node.js fixes HTTP/2 vulnerabilities causing server crashes and memory leaks

# Node.js fixes HTTP/2 vulnerabilities causing server crashes and memory leaks

https://gcdradar.vercel.app/incidents/node-js-fixes-http-2-vulnerabilities-causing-server-crashes · AIR-2026-1921 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability with vendor patches available.
- Fix status: Patched
- First reported: 2026-11-12
- AI role: No AI role
- Products: Node.js

## Summary

Node.js released updates addressing HTTP/2 flaws that allow unauthenticated clients to crash servers and leak memory contents from other connections. Fixed versions are available across the supported release lines.

## What to do

Update Node.js to version 22.23.5, 24.22.3, 26.13.1 or later.

## Affected and fixed versions

- Affected: Node.js 24.x
- Affected: Node.js 26.x
- Fixed in: Node.js 22.23.5
- Fixed in: Node.js 24.22.3
- Fixed in: Node.js 26.13.1

## Latest updates

- 2026-11-12: Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data (https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html)

## Sources

- 2026-11-12 The Hacker News: Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.