# ngtcp2 security updates

Patch Radar has 5 security fixes for ngtcp2, closing 1 CVE. The newest is DEBIAN-CVE-2026-40170 (0.12.1+dfsg-1+deb12u1), released May 15, 2026.

- Web page: https://patchblox.com/security/product/linux/ngtcp2
- Platform: Linux
- Supported: yes

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| [DEBIAN-CVE-2026-40170](https://patchblox.com/security/data/fix/linux/debian-cve-2026-40170.md) | May 15, 2026 | Debian 12.15 (bookworm) 0.12.1+dfsg-1+deb12u1 | High | 1 | 0 |
| [DEBIAN-CVE-2026-40170](https://patchblox.com/security/data/fix/linux/debian-cve-2026-40170.md) | May 15, 2026 | Debian 13.5 (trixie) 1.11.0-1+deb13u1 | High | 1 | 0 |
| [DEBIAN-CVE-2026-40170](https://patchblox.com/security/data/fix/linux/debian-cve-2026-40170.md) | May 15, 2026 | Debian 14 1.22.1-1 | High | 1 | 0 |
| [ALAS2023-2026-1633](https://patchblox.com/security/data/fix/linux/alas2023-2026-1633.md) | Apr 27, 2026 | amzn 2023 1.21.0-1.amzn2023.0.2 | High | 1 | 0 |
| [FEDORA-2026-A0F25484E9](https://patchblox.com/security/data/fix/linux/fedora-2026-a0f25484e9.md) | Apr 20, 2026 | Fedora 43 1.22.1-1.fc43 | High | 1 | 0 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo