HTTP/2 Archives • Daily CyberSecurity

Node.js HTTP/2 and TLS Memory Leak Flaws Fixed in 26.13.1, 24.22.3 and 22.23.5

Node.js HTTP/2 vulnerabilities and TLS memory leak CVE-2026-123864 fixed in 26.13.1

Node.js HTTP/2 and TLS Memory Leak Flaws Fixed in 26.13.1, 24.22.3 and 22.23.5

Do Son November 11, 2026

Node.js fixes 17 bugs, including Node.js HTTP/2 vulnerabilities and a TLS heap leak (CVE-2026-123864). Update to 26.13.1, 24.22.3 or 22.23.5.

Apache Tomcat Fixes Eight Flaws, Including JNDIRealm Authentication Bypass and Response Mix-Ups Apache Tomcat vulnerabilities include authentication bypass and HTTP/2 response mix-up flaws

Apache Tomcat vulnerabilities include authentication bypass and HTTP/2 response mix-up flaws

Apache Tomcat Fixes Eight Flaws, Including JNDIRealm Authentication Bypass and Response Mix-Ups

Do Son October 21, 2026

Eight Apache Tomcat vulnerabilities, including a JNDIRealm authentication bypass, are fixed in 11.0.27, 10.1.61 and 9.0.123. Upgrade now.

cURL Releases Version 8.23.0 to Fix Critical Flaw

Do Son October 15, 2026

The cURL CVE-2026-92392 vulnerability enables remote code execution during HTTP/2 uploads. Update to cURL 8.23.0 or disable HTTP/2 to protect systems.

Node.js Patches 11 Vulnerabilities in July 2026 Security Release Node.js vulnerabilities patched in July 2026 including HTTP/2 use-after-free CVE-2026-56848

Node.js vulnerabilities patched in July 2026 including HTTP/2 use-after-free CVE-2026-56848

Node.js Patches 11 Vulnerabilities in July 2026 Security Release

Do Son July 29, 2026

Node.js patched 11 vulnerabilities in its July 2026 release. The high-severity bugs include a HTTP/2 use-after-free (CVE-2026-56848). Update now.

Millions at Risk: Apache HTTP Server Fixes Critical Remote Code Execution Flaw CVE-2024-39884 Apache HTTP Server RCE CVE-2026-23918

Millions at Risk: Apache HTTP Server Fixes Critical Remote Code Execution Flaw

Do Son May 5, 2026

Apache releases v2.4.67 to fix an HTTP/2 Double Free RCE (CVE-2026-23918) and auth bypasses. Millions of servers are affected—upgrade your infrastructure now!

Node.js Issues Security Updates: High-Severity DoS and Permission Bypasses Patched CVE-2024-21892 Node.js Security Update Server Crash Vulnerability

CVE-2024-21892 Node.js Security Update Server Crash Vulnerability

Node.js Issues Security Updates: High-Severity DoS and Permission Bypasses Patched

Do Son March 25, 2026

Node.js releases critical updates for 20.x to 25.x, fixing high-severity flaws like the __proto__ header crash and TLS errors. Update to v25.8.2 now.

One Character to Rule Them All: How a Missing Slash Bypasses gRPC-Go Security (CVE-2026-33186) gRPC-Go Vulnerability Authorization Bypass

One Character to Rule Them All: How a Missing Slash Bypasses gRPC-Go Security (CVE-2026-33186)

Do Son March 23, 2026

A critical 9.1 CVSS flaw in gRPC-Go (CVE-2026-33186) allows attackers to bypass authorization by omitting a leading slash. Upgrade to v1.79.3 immediately.

Critical Fix: Microsoft Rushes Patch for Windows 11 Localhost Bug

Windows 11 app updates Windows Insider preview build, Calculator app update, built-in Windows apps Windows 11 KB5089549 network lag Windows 11 Home to Pro Education upgrade Windows 11 Start menu update Windows 11 update KB5079391 Windows 11 KB5085516 OOB update Windows 11 C drive permission error Windows 11 C drive access denied Windows native NVMe driver UEFI Secure Boot certificate rotation Windows 11 printer driver policy Windows 11 printer driver deprecation Windows 11 Build 26300 Sysmon Windows 11 Storage settings restriction Windows 11 Build 26300.7674, Windows Insider channel migration 2026 Windows 11 Update Fix KB5073455 shutdown bug, Secure Launch restart loop Windows 11 File Explorer search performance, Search Indexer RAM usage fix Windows 11 Gaming PC Specs, NVMe DirectStorage Windows 10 End of Support Windows 11 Slow Adoption Windows 11 Crash Loop KB5062553 Bug Update and Shut Down, KB5067036 Windows authentication, Kerberos bug Windows 11 fix, localhost bug Windows 11 Update Restart, Update and Shut Down Windows SMBv1 Windows 11 Arm, Easy Anti-Cheat Windows 11 error, Pluton Windows 11 24H2, Easy Anti-Cheat Windows Firewall Bug, Microsoft Update Error Windows 11, JScript9Legacy Windows Activation, TSforge Windows 11 Update, Firewall Error Windows 11 25H2, Annual Update Windows Resiliency Initiative, Kernel Security Windows 11 Upgrade, ESU Program Windows 11 Recall, Data Export Windows 11 Easy Anti-Cheat Windows 11 Update, Cumulative Update Windows Update, ACPI.sys Windows Updates, Enterprise Software Windows 11 Start Data Encryption Standard Printing Problems Windows 11 updates Estimated installation time Smart App Control, Windows 11 security

Critical Fix: Microsoft Rushes Patch for Windows 11 Localhost Bug

Do Son October 21, 2025

Microsoft released an emergency update for Windows 11 (24H2/25H2) to fix the critical bug that broke localhost/127.0.0.1 authentication for developers.

MadeYouReset: New HTTP/2 Flaw Threatens to Cripple Servers with DDoS Attacks MadeYouReset, HTTP/2 vulnerability FSF, AI Scraping Attacks OracleIV botnet

MadeYouReset, HTTP/2 vulnerability FSF, AI Scraping Attacks OracleIV botnet

MadeYouReset: New HTTP/2 Flaw Threatens to Cripple Servers with DDoS Attacks

Do Son August 15, 2025

A new vulnerability, "MadeYouReset," has been discovered in HTTP/2, allowing attackers to exploit stream resets to launch devastating denial-of-service attacks.

Apache Tomcat Patches Trio of Denial-of-Service Flaws CVE-2024-24549 & CVE-2024-23672 Apache Tomcat, DoS Vulnerabilities

Apache Tomcat Patches Trio of Denial-of-Service Flaws

Do Son July 9, 2025

Apache Tomcat 9.0.107 patches three critical DoS flaws (CVE-2025-52434, CVE-2025-52520, CVE-2025-53506) that can disrupt web services via HTTP/2, file uploads, and excessive streams.

Fundamental Web Security Broken: New Attacks Bypass Same-Origin Policy via HTTP/2 & SXG Same-Origin Policy bypass HTTP/2 exploit

Fundamental Web Security Broken: New Attacks Bypass Same-Origin Policy via HTTP/2 & SXG

Do Son May 27, 2025

New CrossPUSH & CrossSXG attacks exploit HTTP/2 and SXG to bypass Same-Origin Policy, enabling XSS and cookie manipulation.