Tim Perry

**Name of the Vulnerable Software and Affected Versions** Node.js version 22 Node.js version 24 **Description** A flaw in the HTTP/2 server API allows servers to continue accepting data after a `GOAWAY` frame has been sent. A `GOAWAY` frame is a mechanism used in the HTTP/2 protocol to notify the peer that the connection is being closed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pac-resolver versions prior to 5.0.0 **Description** This issue occurs due to unsafe PAC file handling when used with untrusted input, allowing for potential remote code execution. The pac-resolver package has over 3 million weekly downloads, and the vulnerability can be exploited in Node.js applications that support auto-proxy configuration. **Recommendations** For versions prior to 5.0.0, the fix for this issue is applied in the node-degenerator library, a dependency written by the same maintainer. As a temporary workaround, consider disabling the use of untrusted input with the pac-resolver package until the issue is resolved. Restrict access to the pac-resolver package to minimize the risk of exploitation.