The Node.js project released Node.js 22.23.3 on September 23, 2026, a patch for its long-term support line. The most important change fixes an HTTP/2 use-after-free bug, a memory error in the code that handles HTTP/2 connections. Anyone serving HTTP/2 from Node.js 22 should plan the upgrade.
Node.js is the runtime that lets JavaScript run on servers instead of only in the browser. Version 22 is a long-term support (LTS) release, which means it gets fixes for years and is what many companies run in production. Its release codename is "Jod."
What the HTTP/2 fix changes
HTTP/2 is the newer version of the web's main protocol. It lets one connection carry many requests at once, each on its own "stream."
A use-after-free bug happens when a program keeps using a piece of memory after it has handed that memory back. The program is then reading or writing data that may belong to something else. Bugs of this kind can crash a program, which is why they get fixed quickly.
According to LinuxCompatible, the problem was a race condition in nghttp2_session_mem_recv2(). That function is part of nghttp2, the library Node.js uses to read HTTP/2 traffic. If a stream was closed while incoming data was still being processed, the code could touch memory that had already been freed. The fix waits to handle the stream-close message, called RST_STREAM, until the receive step has finished.
Neither source gives a CVE number or a severity rating for the bug. The official release notes list it as a bug fix. It does not appear in the project's security release posts, where the most recent entry is from July 2026.
New Node-API functions for SharedArrayBuffer
Node-API is the stable interface that native add-ons use. Native add-ons are modules written in C or C++ that Node.js loads directly, such as database drivers or image libraries.
This release lets those add-ons work with SharedArrayBuffer, a block of memory that several JavaScript threads can read and write at the same time. The release notes add napi_create_external_sharedarraybuffer and extend napi_create_typedarray to accept a SharedArrayBuffer.
Other fixes and dependency updates
Two smaller fixes are listed. One restores the ability to patch the fs file-system module when code loads through the ES module loader. The other fixes how environment variables are escaped on Windows.
The release also updates bundled libraries:
| Component | New version |
|---|---|
| OpenSSL | 3.5.8 |
| Root certificates | NSS 3.125 |
| npm | 10.9.9 |
| corepack | 0.36.0 |
| Undici | 6.28.1 |
| ICU | 78.3 |
| c-ares | 1.34.8 |
| Time zone data | 2026c |
OpenSSL handles encryption for HTTPS. Undici is the HTTP client behind Node's built-in fetch. The root certificates decide which HTTPS sites Node.js trusts by default.
What this means for developers
Check whether your Node.js 22 services speak HTTP/2 directly. That includes servers built on the http2 module, gRPC services and apps that terminate TLS themselves without a proxy in front. Those are the services most exposed to the stream-closing bug, so move them to 22.23.3 first.
Update your base images, not only your laptops. Many teams pin a Node version in a Dockerfile, a CI configuration or an .nvmrc file. Search for 22. in those files and bump each one, then rebuild.
If you maintain a native add-on, the new Node-API functions let you share memory with worker threads without copying it. Add a version check, because these functions exist only in newer releases and older Node 22 builds will not have them.
If your test suite mocks the fs module under ES modules and broke on an earlier 22.x release, rerun it on 22.23.3. The restored patching may let you remove a workaround.
Finally, watch for a CVE. The release notes do not name one, and the project may publish a security advisory later. Until then, treat this as a patch worth taking now rather than waiting for the next scheduled update.
This article was first published on Tech AI Wire.
Also available in
Deutsch · 日本語 · Français · Español · Português
Sources
- Node.js 22.23.3 (LTS) - Node.js
- Node.js 22.23.3 LTS Released with HTTP/2 Use-After-Free Fix - LinuxCompatible
Top comments (0)