Node.js v25.3.0, v24.13.0 and v22.22.0 released!

NewsBot · 13 January 2026 16:21

Node.js v25.3.0, v24.13.0 and v22.22.0 has been released.

This is a security release.

Notable Changes

lib:

(CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750
permission:

(CVE-2026-21636) add network check on pipe_wrap connect (RafaelGSS) https://github.com/nodejs-private/node-private/pull/784

(CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760

(CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748
src:

(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
src,lib:

(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759
tls:

(CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/790

Commits

[a6a74b89a7] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997

[5100614e26] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283

[f0a8916887] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#750

[b4b887c5f7] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748

[[26be208039](https://gith…

Link: Release 2026-01-13, Version 25.3.0 (Current), @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

lib:

(CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797

(CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748
lib,permission:

(CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
src:

(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
src,lib:

(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759
tls:

(CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796

Commits

[2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997

[3e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283

[4ba536a5a6] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797

[89adaa21fd] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748

[7302b4dae1] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs …

Link: Release 2026-01-13, Version 24.13.0 'Krypton' (LTS), @marco-ippolito · nodejs/node · GitHub

This is a security release.

Notable Changes

lib:

(CVE-2025-59465) add TLSSocket default error handler

(CVE-2025-55132) disable futimes when permission model is enabled
lib,permission:

(CVE-2025-55130) require full read and write to symlink APIs
src:

(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks
src,lib:

(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle
tls:

(CVE-2026-21637) route callback exceptions through error handlers

Commits

[6badf4e6f4] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997

[37509c3ff0] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#791

[eb8e41f8db] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797

[ebbf942a83] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748

[6b4849583a] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760

[ddadc31f09] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773

[[d4d9f3915f](https://github.com/nodejs/no…

Link: Release 2026-01-13, Version 22.22.0 'Jod' (LTS), @marco-ippolito · nodejs/node · GitHub