Node.js 22.23.5 LTS security release patches 15 CVEs in HTTP/2, TLS, and permissions

The Node.js project has published version 22.23.5, a security-focused Long-Term Support release for the 'Jod' line, containing fixes for fifteen CVEs across HTTP/2, TLS, HTTP, permissions, and zlib subsystems. Eight of these vulnerabilities are rated high severity, with the majority affecting HTTP/2 stream lifecycle management and TLS session resumption or renegotiation behavior. The release also updates two key dependencies: llhttp to version 9.4.4 and the embedded SQLite engine to 3.54.1.

This update applies to all production deployments running Node.js 22.x LTS, particularly services handling HTTP/2 traffic, mutual TLS authentication, or using the experimental permission model for filesystem access. Administrators should prioritize patching due to the concentration of high-severity network-facing flaws.

HTTP/2 and TLS vulnerability fixes in Node.js 22.23.5

• HTTP/2 stream lifecycle: Multiple high-severity fixes address header release on stream removal, detection of streams abandoned by nghttp2, buffer retention until socket writes complete, stream retention during pending writes, and null write request guards on cancelled streams.
• TLS session integrity: Three related high-severity CVEs prevent TLS resumption, renegotiation, and HelloRetryRequest from altering the Server Name Indication context, plus a fix disabling resumption for mTLS sessions lacking a session ID context.
• SNI context handling: A medium-severity fix ensures Certificate Authority configurations from SNI contexts apply even when no certificate is present in that context.
• HTTP parser hardening: A high-severity fix prevents nested parser execution triggered by empty writes in TLS and HTTP modules, while another medium-severity change redacts proxy credentials from error messages generated by invalid proxy URLs.
• Permission model and dependencies: Low-severity fixes address filesystem permission tree handling on wildcard nodes, heap snapshot destination validation, and denied descendant leakage in recursive fs.watch; llhttp updates to 9.4.4 and SQLite to 3.54.1.

Why it matters

For Linux distributions and container platforms shipping Node.js 22 LTS, this release represents a mandatory security update given the eight high-severity network-facing vulnerabilities. Cloud-native and microservices deployments relying on HTTP/2 for inter-service communication or exposing mTLS endpoints face particular exposure without patching, while the embedded SQLite update benefits applications using the node:SQLite module introduced in this LTS line.