Dev Tools
Node.js 24.22.3 (LTS) Released With Multiple High and Medium Severity Security Fixes
Node.js has issued version 24.22.3 (LTS), codenamed 'Krypton', addressing multiple security vulnerabilities across HTTP/2, TLS, and permissions modules. The release also updates several internal dependencies including SQLite, Brotli, llhttp, and undici.
What Changed
Node.js released version 24.22.3 (LTS), addressing several high-severity security vulnerabilities impacting HTTP/2, TLS, and HTTP components. Notable fixes include preventing nested parser execution from empty writes, addressing a remotely reachable TLS server crash, disabling resumption for mTLS with no session ID context, preventing SNI changes during renegotiation, handshake rotation, or TLS resumption, and fixing multiple HTTP/2 issues like buffer overflow and stream management. Medium-severity vulnerabilities were resolved, such as redacting proxy credentials in invalid proxy URL errors, isolating Agent TLS policy keys, and guarding against null write requests on cancelled streams. Low-severity fixes address recursive file system watch permissions and heap snapshot destination checks. Furthermore, internal dependencies were upgraded, updating brotli to 1.2.1, llhttp to 9.4.4, sqlite to 3.54.1, and undici to 7.30.2.
Why It Matters
This security release rectifies critical vulnerabilities that could otherwise expose Node.js environments to denial-of-service vectors, potential server crashes, improper TLS session handling, and unauthorized information leaks through proxy credential errors or file system permission loopholes. Updating helps maintain application integrity, network security, and compliance with modern hardening standards for production environments.
Practical Impact
Developers and systems administrators running Node.js 24 LTS should plan to update their environments to version 24.22.3. Binaries and installers are provided across multiple platforms including Windows, macOS, Linux, AIX, and ARM architectures, allowing straightforward deployment to patch the highlighted CVEs and integrate updated dependency packages safely.