Checking API Servers for Node.js HTTP/2 Session-Abort Crashes and HTTPS Heap Disclosure
Node.js published security releases on 11 November 2026 covering 16 vulnerabilities, and two of them shape your risk differently: an HTTP/2 class that lets a client shut a server down without credentials, and an HTTPS heap disclosure that is low probability but potentially very high severity. This short walks through the mechanism behind both and the two checks that follow from it. First, a secure HTTP/2 server with a stream handler and no session error listener: a try/catch around the stream body covers the stream layer only, and an 'error' event on the Http2Session with nothing subscribed is thrown, which ends the process. Second, the write-length failure that lets uninitialised heap bytes into a TLS response path when a length comes from the allocation rather than the write. The post is explicit about what the news coverage does and does not confirm. CVE identifiers, affected version ranges, fixed versions and CVSS scores are not in the coverage, so they are not repeated here. Read the advisory at nodejs.org/en/blog/vulnerability before a version number goes into a ticket, a customer email or a compliance document. Full write-up: https://hackyjs.com/posts/checking-api-servers-for-exposure-to-nodejs-http2-session-abort-crashes-and-https-heap-disclosure