Node.js has released security updates addressing 16 vulnerabilities in its HTTP/2, HTTPS, and TLS components.
Seven issues are rated high severity, including memory disclosures and crash risks.
Fixes are available in versions 22.23.5, 24.22.3, and 26.13.1.
What problems were identified?
The errors concern the software that manages secure communications (HTTPS, TLS) and data transfer (HTTP/2) of the applications. Specifically:
- Data leak: In some cases, unauthorized individuals may gain access to information located in the server's memory, including private encryption keys.
- Service breakdown: Some bugs allow third parties to cause the server to suddenly stop working, making it unavailable.
- Bypassing rules: There is a possibility of bypassing the rules that control who has access rights, as well as problems with proper memory management when sharing files.
At this time, there are no indications that these vulnerabilities have been used in actual attacks, and no alternative means of protection beyond updating the software have been announced.
Who is affected and what should they do?
The fixes apply to current versions of Node.js. To protect your systems, you should update your software to the following versions:
- 22.23.5
- 24.22.3
- 26.13.1
It is noted that older versions of Node.js, which are no longer officially supported by the development team, did not receive this update and remain vulnerable.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Nginx Proxy Manager 2.17 fixes an issue that could expose private keys
↗
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)