Node.js 24.22.3 (LTS) security release addresses multiple high-severity vulnerabilities

The Node.js foundation has released version 24.22.3, a Long Term Support (LTS) update specifically designated as a security release. This version addresses a significant number of vulnerabilities, including several classified as high-severity, which primarily impact the runtime's networking and encryption subsystems.

Users running the 'Krypton' LTS branch are affected by these changes, particularly those utilizing HTTP/2 streams or TLS-based communications. The update also includes dependency bumps for core components like SQLite, Brotli, and Undici to ensure continued stability and security across the ecosystem.

Security fixes and dependency updates

• HTTP/2 Subsystem: Multiple high-severity fixes address stream management, including releasing headers when streams are removed, detecting abandoned streams via nghttp2, and retaining buffers/streams during pending socket writes.
• TLS/SSL Security: High-severity patches prevent TLS resumption or renegotiation from changing the Server Name Indication (SNI), disable resumption for mTLS without session ID context, and fix a remotely reachable server crash.
• Data Integrity and Memory: Medium-severity updates include guarding against ALTSVC buffer overflows in HTTP/2 and ensuring inbound DATA retained by streams is correctly charged to the maxSessionMemory limit.
• Dependency Upgrades: The release updates several critical internal dependencies, including SQLite to 3.54.1, Brotli to 1.2.1, llhttp to 9.4.4, and Undici to 7.30.2.

Why it matters

This release is critical for production environments and system administrators managing Node.js-based web servers, as it mitigates potential remote crashes and protocol-level exploits. Software engineers should prioritize this update to maintain the security posture of applications relying on HTTP/2 and TLS-encrypted communications.