Node.js HTTP/2 Security Flaws: Unauthenticated Denial of Service and Memory Disclosure

Node.js developers released security patches addressing 16 flaws across supported release lines. Two of those vulnerabilities stood out because they affect the HTTP/2 protocol handler built into the runtime. The first flaw allows an unauthenticated attacker to send a specially crafted request that crashes the server. The second flaw causes the server to write pieces of its own memory into responses sent to clients, potentially exposing data from other connections or internal operations.

Both bugs affect the 24.x and 26.x release lines. The patches were released in versions 22.23.5, 24.22.3, and 26.13.1. If you maintain a Node.js application and have not yet verified your version, this is the moment to check your deployment.

The first vulnerability allows a remote attacker to send an HTTP/2 frame or header sequence that triggers an unhandled exception in the Node.js HTTP/2 parser. Because no authentication is required, the attacker does not need valid credentials, a session token, or any prior relationship with the server. A single malformed request can bring down the process.

This type of flaw is particularly dangerous in environments where the server handles traffic from untrusted networks. A load balancer in front of multiple Node.js instances might absorb the first crash, but repeated attacks exhaust the pool of available workers. Cloud-hosted applications or those behind a simple reverse proxy are most at risk because there is no secondary layer to rate-limit or filter incoming traffic.

The impact is a straightforward denial of service: legitimate users cannot reach the application until the process restarts and reconnects to the network.

The second flaw is more insidious. Under certain conditions, the HTTP/2 implementation writes uninitialized or previously allocated memory into the response body sent to a client. This means a legitimate attacker who opens an HTTP/2 connection to your server can receive fragments of sensitive data. That data might be a response intended for another user, internal error messages, session tokens, or fragments of database results from parallel requests.

Memory disclosure vulnerabilities are notoriously hard to reproduce and even harder to detect without careful monitoring. An attacker might receive garbage data most of the time, but occasionally a meaningful fragment leaks out. The nature of the leak depends on how the memory allocator in Node.js operates and the order in which requests are processed.

Unlike the crash flaw, this bug requires the attacker to maintain an HTTP/2 connection and may require multiple requests to harvest useful data. However, it requires no authentication and could be automated to scrape data at scale.

HTTP/2 introduces stateful connection management, header compression, and multiplexing that HTTP/1.1 does not have. These features make the parser significantly more complex. A vulnerability in the state machine that manages multiple concurrent streams, or in the compression algorithm itself, can affect the entire connection rather than a single request.

Serverless or microservice architectures that spin up Node.js processes for short-lived workloads are particularly exposed to the crash vulnerability because restarting a process is visible and disruptive. Traditional monolithic applications behind a process manager or container orchestration platform can restart gracefully, though repeated attacks still cause degradation.

HTTP/2 is the default choice for modern APIs and web applications, so the vulnerability surface is broad. If you offer a public API or serve any traffic over HTTPS with HTTP/2 enabled, you are a potential target.

Before patching, identify which Node.js versions you are running in production. A simple check is to run `node --version` on each deployed instance or container. Compare your version against the fixed versions: 22.23.5 or later, 24.22.3 or later, or 26.13.1 or later.

1. Document your current Node.js version across all environments (development, staging, production).
2. Download or pull the patched version for your release line from the official Node.js website or your package manager.
3. Test the new version in a staging environment that mirrors your production traffic patterns, especially if you use HTTP/2 heavily.
4. Schedule the update during a maintenance window or deploy gradually using blue-green deployment if possible.
5. After deployment, verify that the new version is running with `node --version` again.
6. Monitor application logs and error rates for the first few hours to catch any regressions.

If you are using a container image or a platform-managed Node.js runtime (such as AWS Lambda or Heroku), check the provider's documentation for their patching timeline and update process.

The Tor Project and security researchers have long documented that protocol implementations are a frequent source of vulnerabilities, particularly in complex stateful protocols like HTTP/2. Node.js handles millions of requests daily across web applications, real-time APIs, and backend services, so bugs in core protocol handling affect a very large attack surface.

Court records and law-enforcement disclosures show that cryptographic and protocol vulnerabilities are often discovered and weaponized in the wild before public disclosure. Waiting weeks to patch leaves your application exposed to attackers who may already know about the flaw through private channels or reverse-engineering of pre-release versions.

Security vendor incident reports document that denial of service attacks are frequently the opening move in a larger compromise. An attacker may crash your process to distract operations teams while exfiltrating data or planting malware elsewhere. Memory disclosure bugs are similarly used to leak authentication tokens or cryptographic keys that enable follow-on attacks.

Node.js Long-Term Support (LTS) versions receive patches for a longer window than current releases, but all three supported lines received fixes at the same time, signaling that the flaws were considered urgent across the board.

These vulnerabilities are not theoretical. An unauthenticated remote attacker can crash your server or steal data from other users' connections using nothing but a network socket and a malformed HTTP/2 request. The fixes are available, tested, and ready for production.

Start with the most critical step today: verify your Node.js version and confirm whether you are running 22.23.5, 24.22.3, 26.13.1 or later. If not, plan your update for the next available maintenance window. If you run a managed Node.js service or container platform, check with your provider about their patching status rather than assuming the update is automatic.