Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues.
This security release includes the following dependency updates to address public vulnerabilities:
A flaw in Node.js HTTP/2 handling can let retained header blocks evade maxSessionMemory limits and cause remote memory exhaustion.
Thank you, to leduckhuong for reporting this vulnerability and thank you mcollina for fixing it.
A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free.
Thank you, to hahahkim for reporting this vulnerability and thank you mcollina for fixing it.
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
This is an excerpt. The full article is published by Node.js News.
Continue reading at Node.js News