Node.js has issued security updates for versions 20.x, 22.x, 24.x, 25.x, and 26.x to address various vulnerabilities that could lead to process crashes and security issues. The updates resolve problems in TLS error handling, HTTP request processing, WebCrypto implementation, and proxy credential exposure. These vulnerabilities, if exploited, could impact application stability and security.
Node.js has released important security updates for versions 20.x, 22.x, 24.x, 25.x, and 26.x. These updates address vulnerabilities in various components, potentially affecting application security.
The updates address a range of issues, including TLS error handling and HTTP request processing vulnerabilities. A notable flaw could cause crashes due to unhandled exceptions during TLS operations. Another issue in HTTP request processing could lead to uncaught exceptions.
A significant issue in the WebCrypto implementation, where inputs of a certain size could crash the process, has been resolved. Additionally, TLS hostname handling and proxy credential exposure vulnerabilities have been patched.
The updates include dependencies such as undici, llhttp, nghttp2, and openssl. The Node.js Project has acknowledged and thanked the contributors for identifying and fixing these vulnerabilities, highlighting the community's role in enhancing security.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
Node.js has released security updates for versions 22.x, 24.x, and 26.x to address several vulnerabilities. These updates patch issues related to WebCrypto crashes, TLS hostname handling, proxy credential exposure, permission model enforcement, and HTTP/2 client errors, all of which could compromise application security.
Node.js has issued security updates addressing multiple vulnerabilities across versions 20.x, 22.x, 24.x, and 25.x. Key issues include unhandled exceptions in TLS error handling and HTTP request processing, which could lead to crashes and unauthorized IPC endpoint creation.