Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

First reported by Cyber Security News at · Updated · 2 sources

A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections.

Covered by 2 publishers within 5 hours of the first report.

Summary from The Hacker News.

Reporting2

Cyber Security News Node.js Fixes 16 Security Flaws That Could Expose TLS Private Keys and Crash Servers Remotely · Guru Baran
The Hacker News Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data · info@thehackernews.com (The Hacker News)