Node.js patches high-severity DoS flaws in TLS and HTTP request handling

Node.js released security updates for supported 20.x, 22.x, 24.x, and 25.x branches to fix two high-severity, five medium-severity, and two low-severity vulnerabilities, with patched versions issued as v20.20.2, v22.22.2, v24.14.1, and v25.8.2. The most serious bug, CVE-2026-21637, was an incomplete fix in TLS SNICallback handling that could be triggered remotely to cause an uncaught exception and crash affected processes. A second high-severity issue, CVE-2026-21710, allowed specially crafted HTTP requests using a __proto__ header name to trigger a denial of service when applications accessed req.headersDistinct.

The release also addressed Permission Model bypasses, a native crash in URL formatting, a timing side-channel in HMAC verification, an HTTP/2 flow-control memory leak that could lead to memory exhaustion, and a V8 HashDoS weakness; Node.js also updated the undici dependency on 22.x, 24.x, and 25.x to remediate public vulnerabilities. Debian published a corresponding nodejs security update, and the Canadian Centre for Cyber Security urged administrators to review vendor guidance and apply the patched releases, with internet-facing TLS servers identified as the highest-priority systems for remediation.