Node.js Urgently Patches Critical Vulnerabilities Exposing Systems to DoS Attacks

Severity: High (Score: 72.2)

Sources: Cybersecuritynews, Gbhackers, Thecyberexpress

Summary

On March 24, 2026, the Node.js project released version 20.20.2 ‘Iron’ as a critical security update for its Long-Term Support (LTS) branch. This update addresses seven vulnerabilities, including issues with TLS error handling, HTTP/2 flow control, cryptographic timing leaks, and permission model bypasses. Several of these vulnerabilities can be exploited remotely without authentication, significantly increasing the risk of denial-of-service (DoS) attacks and system crashes. The vulnerabilities are tracked under multiple CVEs, although specific CVE identifiers were not provided in the articles. The update is essential for users of Node.js LTS, as the flaws could lead to severe disruptions in service. Security professionals are urged to apply the patches immediately to mitigate risks. The current status indicates that the vulnerabilities are patched, but the potential for exploitation remains a concern until updates are widely applied. Key Points: • Node.js version 20.20.2 released to patch seven critical vulnerabilities. • Vulnerabilities include TLS error handling and HTTP/2 flow control issues. • Exploits can be executed remotely without authentication, risking DoS attacks.

Key Entities

• DDoS (attack_type)
• CVE-2024-36137 (cve)
• CVE-2026-21637 (cve)
• CVE-2026-21710 (cve)
• CVE-2026-21711 (cve)
• CVE-2026-21712 (cve)
• Node.js (tool)