Node.js HTTP/2 Vulnerabilities: Understanding the Server Crash and Data Leak Flaws

Node.js released critical security updates in November addressing 16 total flaws, with two HTTP/2 issues standing out as especially dangerous. The first flaw allows any unauthenticated client to send a specially crafted request that crashes servers running Node.js 24.x or 26.x with HTTP/2 enabled. The second flaw causes a server to inadvertently leak memory from its own process into responses sent to clients, including data that was meant for completely different connections. Both problems require no authentication or privilege escalation; an attacker on the network could trigger them immediately.

Fixed versions became available across all three supported release lines: version 22.23.5 (the long-term support branch), 24.22.3, and 26.13.1. The brevity of the version bumps signals that these are security patches rather than feature releases, and the fact that all three lines were updated simultaneously underscores the severity.

Server administrators running Node.js on the public internet face obvious risk, but the impact extends into privacy-focused infrastructure. Hidden services and onion websites that rely on Node.js are equally vulnerable because HTTP/2 support is enabled by default in recent versions. An attacker who knows a service runs Node.js could exploit the crash vulnerability remotely without needing to compromise credentials or escalate privileges. The data leak is especially problematic in privacy contexts because it could expose fragments of server memory, which might contain encryption keys, session tokens, or unencrypted data that was supposed to stay private.

For anyone hosting a hidden service or running a backend that serves anonymous users, this patch has immediate priority. The anonymity of your users depends partly on your infrastructure not leaking their connection metadata or data to other clients.

The denial-of-service flaw works by sending a malformed HTTP/2 frame sequence that the Node.js HTTP/2 parser cannot handle correctly. When the parser encounters the bad frame, it crashes the entire process rather than closing just that connection. This is a classic parsing vulnerability: code that assumes certain conditions will always hold fails loudly and catastrophically when they do not. The attacker does not need to authenticate, connect to a private endpoint, or perform any setup. They simply craft the request and send it to any service listening on HTTP/2.

A real-world example would be an attacker scanning the internet for Node.js services, then sending the crash payload to each one. Services would drop offline instantly, causing denial of service to all their legitimate users. For hidden services, the same principle applies: if the service is discoverable and runs vulnerable Node.js, it can be crashed by a remote attacker.

The second flaw is more subtle and arguably more dangerous because it does not crash the server, making it harder to detect. When processing certain HTTP/2 frame sequences, the server's response buffer contains not only the data meant for that client but also remnants of previous responses or unrelated server memory. Instead of cleaning that memory or respecting buffer boundaries, the server sends it to the client. The attacker receives fragments that might include:

• Responses meant for other concurrent connections
• Encryption keys or session identifiers stored in memory
• Error messages or debug output that reveals internal structure
• Unencrypted payloads from other users

This is particularly serious on shared infrastructure or busy servers where multiple connections are active simultaneously. An attacker could harvest data intended for hundreds of other clients by sending a carefully timed sequence of HTTP/2 requests.

First, determine which version of Node.js your system is running:

1. Open a terminal or SSH session on the server
2. Run the command: node -v
3. Compare the version against the list below and note whether an update is available

Then follow these steps to patch:

1. Stop your Node.js application or service
2. Update Node.js to one of the fixed versions: 22.23.5 or later (LTS), 24.22.3 or later, 26.13.1 or later
3. Restart your application
4. Verify the new version is running: node -v

If you cannot update immediately, consider disabling HTTP/2 in your application code by using only HTTP/1.1. Check your application's documentation for the HTTP/2 configuration flag, typically named something like createSecureServer options or serverOptions. However, this is a temporary workaround; patching is the correct fix.

The Tor Project documentation and security researchers have established that onion services are not magically insulated from the same infrastructure vulnerabilities that affect public internet services. A flaw in the runtime or protocol your hidden service uses affects it just as much as it affects a public website. Law-enforcement and security vendor incident reports consistently show that infrastructure compromises account for a significant portion of dark web service takedowns. Memory leaks and denial-of-service vulnerabilities are common attack chains in coordinated operations against hidden services. The lesson is that anonymity is lost if the underlying software is compromised, regardless of whether Tor or other privacy tools are in use.

If you run Node.js anywhere, your priority this week is to check your version and apply the patch. If you manage a hidden service, onion website, or any backend that serves privacy-conscious users, treat this as critical: users depend on your infrastructure staying online and not leaking their data. Set a calendar reminder to check for Node.js security advisories on a regular basis, because vulnerabilities in the runtime affect all applications running on it, not just the ones you built yourself. Visit the official Node.js security advisories page (linked from nodejs.org) to confirm the current status of your version and download the patch directly from the official source, never from mirrors or third-party sites.

Source: The Hacker News