Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

November 12, 2026 · 5:12 am 3 sources

Image: The Hacker News

Coverage

More coverage

• Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
  The Hacker News · November 12, 2026 05:12
  A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to…
• Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
  The Hacker News · November 12, 2026 08:20
  A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections. Fixed…
• Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
  The Hacker News · November 12, 2026 09:25
  A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB, the company that makes the…