Loading story…
Node.js released security updates for all active release lines, shipping v22.23.2, v24.18.1, and v26.5.1 to fix 11 vulnerabilities affecting the 22.x, 24.x, and 26.x branches. The most serious issues include two high-severity HTTP/2 flaws, CVE-2026-56846 and CVE-2026-56848, which could let attackers trigger denial of service through memory exhaustion or process crashes, and CVE-2026-58043, a high-severity bypass in the Permission Model that could allow applications started with --permission to access filesystem paths outside the intended allowlist.
The update also addresses weaknesses involving HTTPS connection reuse, mTLS identity reuse, hostname verification bypass, DNS handling, SQLite, zlib APIs, and an HTTP parser issue that could enable request smuggling in Node.js-based forwarding proxies. An oss-sec follow-up noted that an earlier announcement linked to the wrong Node.js blog entry and should instead reference the July security releases page, while maintainers emphasized that unsupported Node.js versions remain exposed and should be retired or upgraded immediately.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Node.js released July 2026 security updates for its active 22.x, 24.x, and 26.x release lines. The patched versions are v22.23.2, v24.18.1, and v26.5.1, addressing 11 vulnerabilities including high-severity flaws affecting HTTP/2 handling and the Permission Model.
An oss-sec mailing list follow-up noted that a link in the Node.js security update announcement was likely incorrect and should point to the July 2026 security releases page instead of the June 2026 page. The correction was raised by Alan Coopersmith in response to Rafael Gonzaga's announcement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Node.js project released security updates across its supported `22.x`, `24.x`, and `26.x` lines to fix 12 vulnerabilities, including two high-severity issues that prompted calls for immediate patching. The most serious bugs are **CVE-2026-48618**, a TLS hostname verification flaw caused by improper handling of Unicode dot separators that can lead to authentication bypass, and **CVE-2026-48933**, a WebCrypto AES integer overflow that can crash processes and enable remote denial-of-service. The releases were announced for all active Node.js lines through the project’s coordinated June security update process and public notices on the `oss-sec` mailing list.
Jun 29, 2026
Node.js released security updates for supported 20.x, 22.x, 24.x, and 25.x branches to fix **two high-severity**, **five medium-severity**, and **two low-severity** vulnerabilities, with patched versions issued as `v20.20.2`, `v22.22.2`, `v24.14.1`, and `v25.8.2`. The most serious bug, `CVE-2026-21637`, was an incomplete fix in TLS `SNICallback` handling that could be triggered remotely to cause an uncaught exception and crash affected processes. A second high-severity issue, `CVE-2026-21710`, allowed specially crafted HTTP requests using a `__proto__` header name to trigger a denial of service when applications accessed `req.headersDistinct`. The release also addressed Permission Model bypasses, a native crash in URL formatting, a timing side-channel in HMAC verification, an HTTP/2 flow-control memory leak that could lead to memory exhaustion, and a V8 **HashDoS** weakness; Node.js also updated the `undici` dependency on 22.x, 24.x, and 25.x to remediate public vulnerabilities. Debian published a corresponding `nodejs` security update, and the Canadian Centre for Cyber Security urged administrators to review vendor guidance and apply the patched releases, with internet-facing TLS servers identified as the highest-priority systems for remediation.
Jul 29, 2026
Red Hat released **Important** security updates for **Node.js 22** across **RHEL 8, RHEL 9, RHEL 9.6 EUS, and RHEL 10**, rebasing affected packages to **Node.js 22.22.2** and updating related RPMs for `x86_64`, `aarch64`, `ppc64le`, and `s390x`. The advisories cover multiple vulnerabilities in Node.js and bundled components including **brace-expansion**, **minimatch**, **undici**, and **nghttp2**, with impacts dominated by denial-of-service conditions and one **HTTP request smuggling** flaw tied to duplicate `Content-Length` headers in `undici`. The fixes span a set of CVEs including `CVE-2026-25547`, `CVE-2026-26996`, `CVE-2026-27904`, `CVE-2026-1525`, `CVE-2026-1526`, `CVE-2026-1528`, `CVE-2026-2229`, `CVE-2026-27135`, and `CVE-2026-21710`. Red Hat’s Bugzilla entry for `CVE-2026-25547` says the **brace-expansion** package could be abused through unbounded brace range expansion, causing exponential CPU and memory consumption and potentially crashing Node.js processes; the issue was patched upstream in version **5.0.1** and incorporated into Red Hat’s errata for supported RHEL releases and lifecycle channels.
Aug 21, 2026