# Node.js 24.22.3 (LTS) security release addresses multiple high-severity vulnerabilities

> **Key takeaway:** Node.js 24.22.3 is a critical security update for the 'Krypton' LTS branch, fixing several high-severity flaws in HTTP/2 and TLS implementations.

**Published:** 2026-11-11T16:45:11+00:00 
**Source:** Node.js Official Releases 
**Category:** software-engineering 
**Canonical URL:** https://fosswire.org/news/nodejs-24223-lts-security-release-addresses-multiple-high-se.html 

## Summary
The Node.js foundation has released version 24.22.3, a Long Term Support (LTS) update specifically designated as a security release. This version addresses a significant number of vulnerabilities, including several classified as high-severity, which primarily impact the runtime's networking and encryption subsystems.

Users running the 'Krypton' LTS branch are affected by these changes, particularly those utilizing HTTP/2 streams or TLS-based communications. The update also includes dependency bumps for core components like SQLite, Brotli, and Undici to ensure continued stability and security across the ecosystem.

## Security fixes and dependency updates
- **HTTP/2 Subsystem:** Multiple high-severity fixes address stream management, including releasing headers when streams are removed, detecting abandoned streams via nghttp2, and retaining buffers/streams during pending socket writes.
- **TLS/SSL Security:** High-severity patches prevent TLS resumption or renegotiation from changing the Server Name Indication (SNI), disable resumption for mTLS without session ID context, and fix a remotely reachable server crash.
- **Data Integrity and Memory:** Medium-severity updates include guarding against ALTSVC buffer overflows in HTTP/2 and ensuring inbound DATA retained by streams is correctly charged to the maxSessionMemory limit.
- **Dependency Upgrades:** The release updates several critical internal dependencies, including SQLite to 3.54.1, Brotli to 1.2.1, llhttp to 9.4.4, and Undici to 7.30.2.

## Why it matters
This release is critical for production environments and system administrators managing Node.js-based web servers, as it mitigates potential remote crashes and protocol-level exploits. Software engineers should prioritize this update to maintain the security posture of applications relying on HTTP/2 and TLS-encrypted communications.