# Node.js patches server crash and memory disclosure flaws across supported lines

_Published Thursday, November 12, 2026 at 5:06 AM EST · Security, Infrastructure · Latest · Tier 2 — Notable_

![Node.js patches server crash and memory disclosure flaws across supported lines — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD-9bYYTxb5WmvOmftwsTAe5hDcHyjm12YlQj320OhT6WqICBOe0D6nQf-PPslE-I0c0r8xvZdTAXfyPwGQxHWRiQ5HSIPEZGEiNrE15ygDNZCRzzVvGugdRlIq6IARQf38iJG-MN-uo7MvdXXcA0wXIGDm0-olouPSw_SbBm2-2CYGHb4uHgtREv2ycI/s1700-nu-rw-lo-l85-e365/nodeks.jpg)

Node.js released versions 22.23.5, 24.22.3 and 26.13.1 to fix 16 vulnerabilities, including seven rated high, The Hacker News reported. The fixes address flaws that let unauthenticated clients crash servers or obtain memory from other connections.

An HTTP/2 crash flaw affects typical default servers on the 24.x and 26.x lines. A separate HTTP/2 memory disclosure flaw affects all three supported lines. An HTTPS flaw can expose TLS private keys and other users' requests when specific request-handling conditions are met; plain HTTP servers using node:http are unaffected by that flaw.

The project's advisory lists updating as the only fix and provides no workaround. End-of-life lines, including 20.x and 25.x, receive no fixes in this release.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html)

---
Canonical: https://techandbusiness.org/newswire/nJ_1idD2mCei8TLmIsKY63
Published: 2026-11-12T10:06:22.718Z
Story chronology: 2026-11-12T08:20:00.000Z
Retrieved: 2026-11-12T13:01:13.321Z
Publisher: Tech & Business (techandbusiness.org)