nodejs-security cve-patch buffer-leak permission-model http2-dos

Node.js security patches fix eight CVEs across active lines

Three high-severity flaws in buffer allocation, permission model, and HTTP/2 handling require immediate updates to 20.x, 22.x, 24.x, 25.x.

July 9, 2026

Summary

Buffer.alloc can leak uninitialized memory containing secrets when vm module timeouts interrupt allocations; symlink bypass breaks fs permission isolation; HTTP/2 malformed frames crash unpatched servers. Patch Tuesday pattern—upgrade within release window or audit permission model usage.

Why it matters

Implementation verdict

Mandatory patch for production: update to 20.20.0, 22.22.0, 24.13.0, or 25.3.0 released December 15, 2025. If using --allow-fs-read/write or permission model, audit symlink paths immediately. If handling TLS client certificates with getPeerCertificate(), apply 24.x patch for memory leak. If async_hooks or AsyncLocalStorage present, this release partially mitigates but does not eliminate DoS risk from deep recursion—prefer input validation over runtime stack exhaustion.

Sources

1.3 high severity issues
2.buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from previous operations
3.A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths
4.A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET
5.Recovery from space exhaustion is unspecified, best‑effort behavior and is not a reliable basis for availability or security

Dev Signal

Get briefs like this in your inbox — free, every weekday.

100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.

Read the full issue →All briefs