Node.js releases fixes for 16 vulnerabilities, 7 rated high

What Node.js is changing

The patched versions are Node.js 26.13.1, 24.22.3 and 22.23.5. Each release lists the fixes in its notes. Some issues affect all three lines, and some only 24.x and 26.x, so the advisory gives the affected lines for each one.

Most of the high-rated flaws are in how Node.js handles HTTP/2 and TLS connections. Examples from the advisory:

• A default HTTP/2 server can be made to crash by an unauthenticated client.
• An HTTP/2 client can make a server leak memory and file descriptors until it fails.
• A flaw in HTTPS can let an unauthenticated client read memory that belongs to other connections, including TLS private keys and other users' requests. It needs a specific pattern in the application's code, and plain node:http without TLS is not affected.
• A TLS 1.2 renegotiation flaw can let a client reach a host it is not allowed to reach, on servers that use different client-certificate rules for different hostnames.

The medium and low issues include a certificate validation bypass in https.Agent, proxy credentials appearing in error messages, and gaps in the Permission Model.

Which systems are affected

Any software that runs on Node.js 22, 24 or 26 may be affected: websites, APIs, web applications and back-office tools. How exposed you are depends on how the application is built. For example, the HTTP/2 and TLS issues matter most where Node.js itself accepts those connections, rather than a managed host or load balancer in front of it. That can reduce the risk but does not remove the need to update. The release does not cover older lines, so ask your developers which version you run.

What to do

1. Ask your developers or host which Node.js version each live system runs.
2. Update to 26.13.1, 24.22.3 or 22.23.5, and test before release as you normally would.
3. If the software runs in containers, rebuild and redeploy the images. Updating a server does not change a version that is baked into an image.
4. Put the update on a date. If nobody owns updates to this system, that is the gap to fix: see ongoing support and ownership.

This is general information. Your developers or host should confirm what applies to your setup.