Node.js Releases Updates to Fix 16 Vulnerabilities, Including Critical HTTP/2 and HTTPS Bugs

Node.js has released fixed versions (22.23.5, 24.22.3, and 26.13.1) to address 16 vulnerabilities, with seven rated as high severity. Among the critical flaws are HTTP/2 bugs (CVE-2026-123863, CVE-2026-123866) that could lead to server crashes or data leakage, and an HTTPS server vulnerability (CVE-2026-123864) allowing unauthenticated clients to read memory, including TLS private keys. These updates are crucial for maintaining the security and stability of Node.js applications and servers.