Node.js Patches 11 Security Flaws Enabling Memory Exhaustion, File Access and Request Smuggling

Node.js has released critical security updates addressing 11 vulnerabilities across its 26.x, 24.x, and 22.x release lines, including high-severity flaws that could enable remote memory exhaustion, filesystem access bypass, and HTTP request smuggling attacks. The updates, published on July 29, 2026, include patches for core components and dependency upgrades, including undici, the HTTP client, and llhttp, the HTTP parser. The most severe issues affect widely used runtime…