Node.js v26.12.1, v24.22.1 and v22.23.4 released!

NewsBot · 21 October 2026 12:21

Node.js v26.12.1, v24.22.1 and v22.23.4 has been released.

This is a security release.

Notable Changes

(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High

(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High

(CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High

(CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High

(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High

(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium

(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium

(CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low

(CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low

(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low

deps: V8: backport 93cd21e8254b (Joyee Cheung)

crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)

tls: reject chains containing blocked public keys (Ulises Gascon)

deps: update c-ares to 1.34.9 (Node.js GitHub Bot)

tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)

crypto: harden X.509 conversion and formatting (Filip Skokan)

Commits

[818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877

[fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966

[acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-priv…

Link: Release 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)

(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)

(CVE-2026-105483) tls: fix ip normalization regression (James M Snell)

(CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)

(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)

(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)

(CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)

(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)

crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)

deps: update c-ares to 1.34.9 (Node.js GitHub Bot)

deps: update timezone to 2026e (Node.js GitHub Bot)

deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)

deps: update undici to 7.30.1 (Node.js GitHub Bot)

Commits

[2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877

[4d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987

[4b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007

[9243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496

[1e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHu…

Link: Release 2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95 · nodejs/node · GitHub

This is a security release.

Notable Changes

(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)

(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)

(CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)

(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)

(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)

(CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)

(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)

crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)

deps: update c-ares to 1.34.9 (Node.js GitHub Bot)

deps: update timezone to 2026e (Node.js GitHub Bot)

deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)

deps: update sqlite to 3.53.4 (Node.js GitHub Bot)

deps: update undici to 6.29.1 (Node.js GitHub Bot)

Commits

[68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877

[dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987

[a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966

[ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496

[a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) [#66868](https:…

Link: Release 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95 · nodejs/node · GitHub