NewsThe Hacker News
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
More on Connections
Other advisories
- HighCVE-2026-125323pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
- HighCVE-2026-125323pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
- HighCVE-2026-125323pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
- HighCVE-2026-123866A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a…
- HighCVE-2026-123864A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' re…
- MediumCVE-2026-126614The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which all…
- MediumCVE-2026-121472The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who …
- Not ratedosv:CLEANSTART-2026-KA47707Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason
Other news entries
- Apify rotates API tokens, prompts 2FA resets after breachNewsBleepingComputer
- Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other ServersNewsThe Hacker News
- DreamHost forces password resets in ongoing "incident"NewsBleepingComputer
- Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP ConnectionsNewsSecurityWeek
- Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH ConnectionsNewsThe Hacker News
- Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security ConcernsNewsThe Hacker News
- Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidthNewsBleepingComputer
- Microsoft: September Windows updates break Always On VPN connectionsNewsBleepingComputer
Source: https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html
ID