Apache 2.4.71 fixes a critical HTTP/2 flaw that can run code on servers
Apache HTTP Server 2.4.71 closes CVE-2026-119618, a critical mod_http2 bug that affects every release from 2.4.55 to 2.4.70.
HTTP/2
Node.js patches 16 flaws, one can leak TLS private keys
Node.js 22.23.5, 24.22.3 and 26.13.1 fix 16 flaws, among them a memory leak that can expose TLS private keys and several HTTP/2 crashes.