# Node.js v25.8.2, v24.14.1 and v22.22.2 released!

**URL:** <https://forum.devtalk.com/t/node-js-v25-8-2-v24-14-1-and-v22-22-2-released/238869>\
**Category:** Backend Official News\
**Tags:** newsbot, official-news, nodejs\
**Created:** [24 March 2026 22:22 UTC](https://forum.devtalk.com/t/node-js-v25-8-2-v24-14-1-and-v22-22-2-released/238869 "2026-03-24T22:22:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NewsBot](https://forum.devtalk.com/user_avatar/forum.devtalk.com/newsbot/32/1114_2.png) [@NewsBot](https://forum.devtalk.com/u/NewsBot)\
**Post date:** [24 March 2026 22:22 UTC](https://forum.devtalk.com/t/node-js-v25-8-2-v24-14-1-and-v22-22-2-released/238869/1 "2026-03-24T22:22:23Z")

</div>

[Node.js](https://devtalk.com/nodejs) v25.8.2, v24.14.1 and v22.22.2 has been released.

> [@](#):
>
> This is a security release.
> 
> ### Notable Changes
> 
> - (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High
> - (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High
> - (CVE-2026-21711) include permission check to `pipe_wrap.cc` (RafaelGSS) - Medium
> - (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
> - (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
> - (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium
> - (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
> - (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low
> - (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low
> 
> ### Commits
> 
> - [[`2086b7477b`](https://github.com/nodejs/node/commit/2086b7477b)] - **(CVE-2026-21717)**  **build,test** : test array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834)
> - [[`0f9332a40a`](https://github.com/nodejs/node/commit/0f9332a40a)] - **(CVE-2026-21713)**  **crypto** : use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
> - [[`2b6937ddb2`](https://github.com/nodejs/node/commit/2b6937ddb2)] - **deps** : update undici to 7.24.4 (Node.js GitHub Bot) [#62271](https://github.com/nodejs/node/pull/62271)
> - [[`bfb8ad5787`](https://github.com/nodejs/node/commit/bfb8ad5787)] - **deps** : update undici to 7.24.3 (Node.js GitHub Bot) [#62233](https://github.com/nodejs/node/pull/62233)
> - [[`be6384727f`](https://github.com/nodejs/node/commit/be6384727f)] - **deps** : upgrade npm to 11.11.1 (npm team) [#62216](https://github.com/nodejs/node/pull/62216)
> - [[`2feea5bb97`](https://github.com/nodejs/node/commit/2feea5bb97)] - **deps** : V8: override `depot…

Link: [Release 2026-03-24, Version 25.8.2 (Current), @RafaelGSS · nodejs/node · GitHub](https://github.com/nodejs/node/releases/tag/v25.8.2)

> [@](#):
>
> This is a security release.
> 
> ### Notable Changes
> 
> - (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
> - (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
> - (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
> - (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
> - (CVE-2026-21714) handle NGHTTP2\_ERR\_FLOW\_CONTROL error code (RafaelGSS) - Medium
> - (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
> - (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
> - (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
> 
> ### Commits
> 
> - [[`6fae244080`](https://github.com/nodejs/node/commit/6fae244080)] - **(CVE-2026-21717)**  **build,test** : test array index hash collision (Joyee Cheung) [nodejs-private/node-private#828](https://github.com/nodejs-private/node-private/pull/828)
> - [[`cc0910c62e`](https://github.com/nodejs/node/commit/cc0910c62e)] - **(CVE-2026-21713)**  **crypto** : use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
> - [[`80cb042cf3`](https://github.com/nodejs/node/commit/80cb042cf3)] - **deps** : update undici to 7.24.4 (Node.js GitHub Bot) [#62271](https://github.com/nodejs/node/pull/62271)
> - [[`f5b8667dc2`](https://github.com/nodejs/node/commit/f5b8667dc2)] - **deps** : update undici to 7.24.3 (Node.js GitHub Bot) [#62233](https://github.com/nodejs/node/pull/62233)
> - [[`08852637d9`](https://github.com/nodejs/node/commit/08852637d9)] - **deps** : update undici to 7.22.0 (Node.js GitHub Bot) [#62035](https://github.com/nodejs/node/pull/62035)
> - [[`61097db9fb`](https://github.com/nodejs/node/commit/61097db9fb)] - **deps** : upgrade npm to 11.11.0 (npm team) [#61994](https://github.com/nodejs/node/pull/61994)
> - [[`9ac0f9f81e`]…

Link: [Release 2026-03-24, Version 24.14.1 'Krypton' (LTS), @RafaelGSS prepared by @juanarbol · nodejs/node · GitHub](https://github.com/nodejs/node/releases/tag/v24.14.1)

> [@](#):
>
> This is a security release.
> 
> ### Notable Changes
> 
> - (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High
> - (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High
> - (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
> - (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium
> - (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
> - (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low
> - (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low
> 
> ### Commits
> 
> - [[`6f14ee5101`](https://github.com/nodejs/node/commit/6f14ee5101)] - **(CVE-2026-21717)**  **build,test** : test array index hash collision (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
> - [[`52a52ef619`](https://github.com/nodejs/node/commit/52a52ef619)] - **(CVE-2026-21713)**  **crypto** : use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
> - [[`30a3ab11e2`](https://github.com/nodejs/node/commit/30a3ab11e2)] - **(CVE-2026-21717)**  **deps** : V8: cherry-pick aac14dd95e5b (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
> - [[`e3f4d6a42e`](https://github.com/nodejs/node/commit/e3f4d6a42e)] - **(CVE-2026-21717)**  **deps** : V8: backport 1361b2a49d02 (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
> - [[`7dc00fa5f4`](https://github.com/nodejs/node/commit/7dc00fa5f4)] - **(CVE-2026-21717)**  **deps** : V8: backport 185f0fe09b72 (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
> - [[`076acd052d`](https://github.com/nodejs/node/commit/076acd052d)] - **(CVE-2026-21717)**  **deps** :…

Link: [Release 2026-03-24, Version 22.22.2 'Jod' (LTS), @RafaelGSS prepared by @aduh95 · nodejs/node · GitHub](https://github.com/nodejs/node/releases/tag/v22.22.2)