ThinkFacility Sign in
  1. Home
  2. Security
  3. Node.js
HighNode.js

Node.js 22, 24 and 26: seven high-severity HTTP/2 and TLS server flaws, update now

Anyone running a Node.js server, especially one that speaks HTTPS or HTTP/2.

How to fix it

You haveUpdate to
< 22.23.5→22.23.5< 24.22.3→24.22.3< 26.13.1→26.13.1

Check your version

Your Node.js version
node -v

Update

nvm (macOS / Linux) · 22.23.5
nvm install 22.23.5
nvm alias default 22.23.5
nvm (macOS / Linux) · 24.22.3
nvm install 24.22.3
nvm alias default 24.22.3
nvm (macOS / Linux) · 26.13.1
nvm install 26.13.1
nvm alias default 26.13.1
nvm-windows · 22.23.5
nvm install 22.23.5
nvm use 22.23.5
nvm-windows · 24.22.3
nvm install 24.22.3
nvm use 24.22.3
nvm-windows · 26.13.1
nvm install 26.13.1
nvm use 26.13.1
macOS (Homebrew)
brew update && brew upgrade node
Windows (winget, LTS)
winget upgrade OpenJS.NodeJS.LTS
Docker · 22.23.5
docker pull node:22.23.5
Docker · 24.22.3
docker pull node:24.22.3
Docker · 26.13.1
docker pull node:26.13.1

The release fixes 16 flaws; the seven Node.js rates High are listed here. With several, an unauthenticated client can crash an HTTP/2 or TLS server or read memory from other connections, TLS private keys included. Versions past end of life are always affected and get no fix, so move to a supported line.

Sources