Loading story…
Node.js released security updates for supported 20.x, 22.x, 24.x, and 25.x branches to fix two high-severity, five medium-severity, and two low-severity vulnerabilities, with patched versions issued as v20.20.2, v22.22.2, v24.14.1, and v25.8.2. The most serious bug, CVE-2026-21637, was an incomplete fix in TLS SNICallback handling that could be triggered remotely to cause an uncaught exception and crash affected processes. A second high-severity issue, CVE-2026-21710, allowed specially crafted HTTP requests using a __proto__ header name to trigger a denial of service when applications accessed req.headersDistinct.
The release also addressed Permission Model bypasses, a native crash in URL formatting, a timing side-channel in HMAC verification, an HTTP/2 flow-control memory leak that could lead to memory exhaustion, and a V8 HashDoS weakness; Node.js also updated the undici dependency on 22.x, 24.x, and 25.x to remediate public vulnerabilities. Debian published a corresponding nodejs security update, and the Canadian Centre for Cyber Security urged administrators to review vendor guidance and apply the patched releases, with internet-facing TLS servers identified as the highest-priority systems for remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Node.js published a product advisory for its Wednesday, June 17, 2026 security releases. This is a new vendor security release distinct from the March 2026 advisories already in the timeline.
On March 25, 2026, the Canadian Centre for Cyber Security published advisory AV26-277 about the Node.js vulnerabilities. It recommended that users and administrators review the vendor guidance and apply the necessary updates for affected Node.js 20, 22, 24, and 25 versions.
Node.js published a technical advisory titled "Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8." This documented technical details related to the HashDoS issue addressed in the March 2026 security releases.
On March 24, 2026, Node.js published security advisories and patched releases for the 20.x, 22.x, 24.x, and 25.x lines. The updates fixed two high-severity, five medium-severity, and two low-severity issues, including CVE-2026-21637 and an HTTP denial-of-service flaw, with patched versions v20.20.2, v22.22.2, v24.14.1, and v25.8.2.
Debian issued security advisory DSA-6166-1 for Node.js. The reference indicates a Node.js security update was published by Debian on that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcethecyberexpress.com
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcenodejs.org
Open sourceseclists.org
Open sourcenodejs.org
Open sourcelists.debian.org
Open sourcenodejs.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Node.js project released security updates across its supported `22.x`, `24.x`, and `26.x` lines to fix 12 vulnerabilities, including two high-severity issues that prompted calls for immediate patching. The most serious bugs are **CVE-2026-48618**, a TLS hostname verification flaw caused by improper handling of Unicode dot separators that can lead to authentication bypass, and **CVE-2026-48933**, a WebCrypto AES integer overflow that can crash processes and enable remote denial-of-service. The releases were announced for all active Node.js lines through the project’s coordinated June security update process and public notices on the `oss-sec` mailing list.
Jun 29, 2026
Multiple upstream language/runtime and core library projects disclosed and/or patched significant vulnerabilities affecting widely deployed developer and production environments. **Deno** reported two issues: **CVE-2026-22863** (CVSS 9.2) in the `node:crypto` compatibility layer where `cipher.final()` fails to properly finalize/close cipher state, enabling “infinite encryptions” that could aid attacks aimed at learning server secrets; and **CVE-2026-22864**, a Windows-specific command execution weakness involving a bypass in `Deno.Command` protections when executing batch files, undermining intended shell-injection safeguards. **glibc** maintainers disclosed **CVE-2026-0861** (CVSS 8.4), an integer overflow in `memalign`, `posix_memalign`, and `aligned_alloc` affecting versions 2.30–2.42 that can lead to heap corruption when an attacker can control unusually large `size` values and alignment parameters, and **CVE-2026-0915**, a decades-old information leak in `getnetbyaddr`/`getnetbyaddr_r` affecting versions 2.0–2.42 that can expose uninitialized stack contents to DNS backends when querying a zero-valued network. Separately, the **Go** team released security updates (*Go* 1.25.6 and 1.24.12) addressing six vulnerabilities across the standard library (e.g., `archive/zip`, `net/http`, `crypto/tls`) and the toolchain, including a ZIP-processing CPU-exhaustion DoS (**CVE-2025-61728**) and toolchain issues that could enable command execution in certain developer/build scenarios; organizations running Go services or CI/build pipelines were advised to upgrade to the patched releases.
Jun 29, 2026
Netty published a broad set of security advisories covering **22 vulnerabilities** across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including **HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling**. Reported consequences include uncontrolled memory allocation, `ByteBuf` and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse. One of the most serious flaws, **`CVE-2026-45416`**, allows a remote attacker to send as little as **nine bytes** in a crafted TLS `ClientHello` and trigger roughly **16 MiB** of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects **Netty 4.1.x before `4.1.135.Final`** and **4.2.0.Final through `4.2.14.Final`**, and was fixed in **`4.1.135.Final`** and **`4.2.15.Final`**; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Jul 10, 2026