Signal #134: Node.js Security Patches Land Across Three Lines, and Gemini Gets a Decisions API

This week's issue is dominated by one theme that should be familiar to anyone running Node in production: a coordinated batch of security releases across the 22, 24, and 26 lines, with HTTP/2 and TLS taking most of the damage. Alongside that, AWS added a direct, SigV4-signed web search call, JetBrains shipped fixes for a certificate compromise that OS updates won't cover, and Google released a single-pass API for scoring bounded decisions. Most of this is patch work, which is the least glamorous and most urgent kind.

Node.js 22.23.5 ships security fixes across HTTP, TLS, and zlib

Node 22.23.5 patches 17 CVEs, eight of them rated High, touching HTTP/2 stream and buffer handling, TLS SNI and session resumption, and dependency updates to llhttp and SQLite. The High-severity items include unbounded memory retention on abandoned HTTP/2 streams and SNI changes during resumption, both reachable by any client that can talk to your server. The release also redacts proxy credentials from error messages, which changes what lands in your logs, so check whether any of your log pipelines were depending on those strings.

If you run Node 22 and terminate HTTP/2, TLS, or mTLS, this is not optional. The release replaces 22.23.4 and earlier, and no migration or configuration change is described, so it is a drop-in patch upgrade. Install from nodejs.org or your version manager, verify against the published SHASUMS256 file before deploying, and prioritize internet-facing HTTP/2 and mTLS workloads.

Verdict: Ship. Patch now, and treat it as a deployment priority rather than routine maintenance.

AWS Web Search API adds SigV4-signed direct search calls

A single InvokeWebSearch call, signed with SigV4, returns ranked and filtered web results without provisioning an AgentCore Gateway or any other resources. For custom agent loops, pipelines, and dashboards that only need occasional grounding, this removes a lot of plumbing. The same IAM action and resource cover both the direct route and the gateway route, so your existing policies carry over.

The integration requires bedrock-agentcore:InvokeWebSearch on arn:aws:bedrock-agentcore:us-west-2:aws:tool/web-search.v1 and Boto3 1.43.127 or later for Python. The limits are firm: 25 results maximum, 200-character queries, and 100 domains per filter list. The results come from Amazon's own index, which is the number that matters most. Before you rely on it, run your actual domains through it and measure coverage, because index quality varies by vertical.

Verdict: Evaluate. Good for replacing hand-rolled search integrations on simple lookups; validate coverage before committing production traffic to it.

JetBrains Patches eMudhra Certificate Compromise Across IDEs

Eight compromised eMudhra intermediate certificates allow network attackers to impersonate services, and JetBrains has shipped fixes across its IDEs, Toolbox, and the jetbrainsd background service. The detail that matters is where the trust decisions live: JetBrains IDEs validate TLS against their bundled JetBrains Runtime trust store, so updating your operating system's certificate store does not close the gap. The embedded JCEF browser and jetbrainsd each maintain separate trust stores that need their own fixes.

Fixed builds run from 2025.2 through 2026.3 RC. Versions 2025.1 and earlier, along with Toolbox 3.7 and earlier, receive no fix at all, so if you are on either, the answer is upgrade rather than patch. If you genuinely cannot update immediately, the advisory documents a cacerts cleanup and a JCEF disable workaround.

Verdict: Ship. Update to the latest bugfix release; treat the documented workarounds as a stopgap, not a destination.

Node.js 24.22.3 ships security fixes across HTTP/2 and TLS

Node 24.22.3 closes 20 CVEs, nine rated High, across HTTP/2 stream handling and TLS SNI and resumption. Any service exposing HTTP/2 or TLS endpoints on Node 24 is exposed to remotely reachable crash and memory issues. The release also bumps llhttp, undici, brotli, and sqlite, and those dependency changes can shift behavior in code you don't own, even though the release notes describe it simply as "a security release" with no code changes.

That combination is why this needs a test pass, not just a version bump. Install the official binary or package, verify SHASUMS, and run your HTTP/2 and mTLS test suites before rolling to production. The release replaces 24.22.2 and earlier.

Verdict: Ship, after running your HTTP/2 and mTLS tests against the new build.

Gemini Decisions API scores bounded choices in one pass

Gemini Decision 1 scores a closed set of options in a single forward pass and returns probabilities and confidence rather than generated text, with the vendor quoting 150-250 ms end to end. For routing, policy checks, and classification, this is a meaningful shape change: you get calibrated confidence without generating output tokens, which lets you send ambiguous cases to a fallback model or a human reviewer. Input is billed once per request regardless of how many questions you ask, which matters if you are scoring many options against the same context.

Access requires a Gemini API key from Google AI Studio, the v1beta endpoint through client.decisions.create, and the Interactions API input format. The latency and accuracy figures are vendor benchmarks on a brand-new API. Calibration in particular is the claim you should not take on faith; measure it on your own labeled data, especially around the confidence threshold where you'd route to a fallback.

Verdict: Evaluate. Worth prototyping for low-latency routing and tool selection; do not put it in front of production decisions until calibration holds on your data.

Node.js 26.13.1 ships security fixes for TLS and HTTP/2

Node 26.13.1 patches 19 CVEs, nine rated High, including a remotely reachable TLS server crash tracked as CVE-2026-126051 and SNI-related fixes to TLS resumption and renegotiation. The HTTP/2 stream lifecycle fixes change retention behavior, and dependency bumps to undici, llhttp, and brotli alter fetch, HTTP parsing, and compression. The release notes state no code changes are required, but the stream retention and session resumption changes are exactly the kind of behavior that breaks quietly under load.

This is a security release on the LTS line, so patch production immediately. Verify the SHASUMS against the signed file before deploying, and test your HTTP/2 and mTLS paths in staging, paying attention to long-lived connections and session reuse.

Verdict: Ship. Patch production now, with HTTP/2 and mTLS verification in the same change window.

If you want this kind of triage every week, with the upgrade calls already made for you, subscribe to Signal at https://repowrapped.com/signal. We cover the tools worth touching and the ones worth waiting on, so your next patch window is spent on the right things.