TechnologyWednesday, November 11, 20261 min read

Node.js 22.23.5 (LTS)

By Engineering Blogs · Published by Everything Blog

In short

Announced by Antoine du Hamel, the maintenance update focuses on safeguarding critical networking modules within the runtime. High-severity patches resolve buffer retention in http2, prevent nested parser execution during empty writes, and correct renegotiation flaws in TLS. The release also remediates proxy credential exposure, file system monitoring permission leaks, and updates external dependencies including sqlite to version 3.54.1.

Key points

Production environments should deploy this update to correct critical TLS renegotiation f…: Production environments should deploy this update to correct critical TLS renegotiation flaws involving mutual TLS and SNI.
Lower-level patches strengthen system security by fixing proxy credential redaction and f…: Lower-level patches strengthen system security by fixing proxy credential redaction and file system permission leaks.
The release ensures safer diagnostic routines by adding destination checks during heap sn…: The release ensures safer diagnostic routines by adding destination checks during heap snapshot generation.

Sources checked by our analysis pipeline: 1

Antoine du Hamel

2026-11-11, Version 22.23.5 'Jod' (LTS), @aduh95

This is a security release.

Notable Changes

- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High

- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High

- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High

- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High

- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High

- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High

- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High

- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High

- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium

- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium

- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium

- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo…

AI Analysis

Tone

Neutral

In short

Key Points

Production environments should deploy this update to correct critical TLS renegotiation f…: Production environments should deploy this update to correct critical TLS renegotiation flaws involving mutual TLS and SNI.
Lower-level patches strengthen system security by fixing proxy credential redaction and f…: Lower-level patches strengthen system security by fixing proxy credential redaction and file system permission leaks.
The release ensures safer diagnostic routines by adding destination checks during heap sn…: The release ensures safer diagnostic routines by adding destination checks during heap snapshot generation.

Topics

Technology

Was this summary useful?

AI Analysis

Tone

Neutral

In short

Key Points

Production environments should deploy this update to correct critical TLS renegotiation f…: Production environments should deploy this update to correct critical TLS renegotiation flaws involving mutual TLS and SNI.
Lower-level patches strengthen system security by fixing proxy credential redaction and f…: Lower-level patches strengthen system security by fixing proxy credential redaction and file system permission leaks.
The release ensures safer diagnostic routines by adding destination checks during heap sn…: The release ensures safer diagnostic routines by adding destination checks during heap snapshot generation.

Topics

Technology

Was this summary useful?

Loot boxes, influencers, and addictive features face an EU crackdown
European regulators are advancing sweeping draft legislation aimed at eliminating manipulative digital designs across e-commerce, gaming, and social networks. The measure is projected to preserve up to €13.7 billion annually for consumers by curbing exploitative commercial tactics. Platforms that fail to comply could face severe penalties reaching up to six percent of their global annual turnover.
3 min read
Air gapped, not data dark: how Bright Machines gives customers live factory dashboards without opening the plant
Industrial software provider Bright Machines has launched a secure data pipeline to deliver minute-level analytics from inside isolated manufacturing environments. By restricting traffic strictly to an outbound pathway, the architecture avoids exposing sensitive production lines to external network threats. This allows enterprise clients to inspect critical floor metrics without compromising strict plant-level security protocols.
9 min read
Node.js 24.22.3 (LTS)
Maintainers have issued a critical maintenance update, codenamed "Krypton," to protect enterprise applications from severe network-level threats. The security release eliminates dangerous flaws across core networking components that could otherwise trigger remote server crashes or compromise encrypted communications. Applying these patches ensures stable HTTP/2 operations and safeguards sensitive infrastructure against credential exposure.
4 min read

Node.js 22.23.5 (LTS)

In short

Key points

More in Technology