Node.js v26.3.1, v24.17.0 and v22.23.0 released!

NewsBot · 18 June 2026 05:21

Node.js v26.3.1, v24.17.0 and v22.23.0 has been released.

This is a security release.

Notable Changes

(CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High

(CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High

(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium

(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium

(CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium

(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium

(CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium

(CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low

(CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low

(CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

(CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

Commits

[98fbc89211] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878

[110840f2c7] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890

[8d36d522b2] - deps: update undici to 8.5.0 (Node.js GitHub Bot) #63903

[2e6d03993a] - deps: update undici to 8.4.0 (Node.js GitHub Bot) #63779

[5a17d5b07a] - deps: upd…

Link: Release 2026-06-18, Version 26.3.1 (Current), @aduh95 · nodejs/node · GitHub

This is a security release.

Notable Changes

(CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High

(CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High

(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium

(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium

(CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium

(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium

(CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium

(CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium

(CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low

(CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low

(CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

[9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878

[cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890

[a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891

[66e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891

[[dd627ced27](https://github.com…

Link: Release 2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95 · nodejs/node · GitHub

This is a security release.

Notable Changes

(CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High

(CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High

(CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium

(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium

(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium

(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium

(CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium

(CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium

(CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low

(CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low

(CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

[38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878

[ad8a10c1bb] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890

[ca825a87cc] - deps: update undici to 6.27.0 (aduh95) #63711

[a1a5bb9683] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891

[0f48583512]…

Link: Release 2026-06-18, Version 22.23.0 'Jod' (LTS), @aduh95 · nodejs/node · GitHub