Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues.
This security release includes the following dependency updates to address public vulnerabilities:
A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB.
This vulnerability affects all supported release lines: Node.js 22 , Node.js 24 , and Node.js 26 .
Thank you, to erichen for reporting this vulnerability and thank you Filip Skokan for fixing it.
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch.
This is an excerpt. The full article is published by Node.js News.
Continue reading at Node.js News