diff --git a/apps/site/pages/en/blog/release/v22.23.2.md b/apps/site/pages/en/blog/release/v22.23.2.md new file mode 100644 index 0000000000000..4a6dfaf7f5140 --- /dev/null +++ b/apps/site/pages/en/blog/release/v22.23.2.md @@ -0,0 +1,126 @@ +--- +date: '2026-07-29T14:01:35.511Z' +category: release +title: Node.js 22.23.2 (LTS) +layout: blog-post +author: Marco Ippolito +--- + +## 2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolito + +This is a security release. + +### Notable Changes + +- (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High +- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High +- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High +- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium +- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium +- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium +- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium +- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low +- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low +- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low +- deps: update llhttp to 9.4.3 (Paolo Insogna) +- deps: update undici to 6.28.0 (Node.js GitHub Bot) + +### Commits + +- \[[`4b12ac38a1`](https://github.com/nodejs/node/commit/4b12ac38a1)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) +- \[[`3fd0aa51d0`](https://github.com/nodejs/node/commit/3fd0aa51d0)] - **deps**: update undici to 6.28.0 (Node.js GitHub Bot) [#64714](https://github.com/nodejs/node/pull/64714) +- \[[`22efc051a3`](https://github.com/nodejs/node/commit/22efc051a3)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) +- \[[`c8525ac3a6`](https://github.com/nodejs/node/commit/c8525ac3a6)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#932](https://github.com/nodejs-private/node-private/pull/932) +- \[[`daa6d25e3d`](https://github.com/nodejs/node/commit/daa6d25e3d)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921) +- \[[`f14d78b9e0`](https://github.com/nodejs/node/commit/f14d78b9e0)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#63752](https://github.com/nodejs/node/pull/63752) +- \[[`51123159fe`](https://github.com/nodejs/node/commit/51123159fe)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#934](https://github.com/nodejs-private/node-private/pull/934) +- \[[`acaf4266b2`](https://github.com/nodejs/node/commit/acaf4266b2)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930) +- \[[`440329f624`](https://github.com/nodejs/node/commit/440329f624)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911) +- \[[`ed18b9cc07`](https://github.com/nodejs/node/commit/ed18b9cc07)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926) +- \[[`0566c3cccd`](https://github.com/nodejs/node/commit/0566c3cccd)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927) +- \[[`0d072480c3`](https://github.com/nodejs/node/commit/0d072480c3)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931) + +Windows 32-bit Installer: https://nodejs.org/dist/v22.23.2/node-v22.23.2-x86.msi \ +Windows 64-bit Installer: https://nodejs.org/dist/v22.23.2/node-v22.23.2-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.23.2/node-v22.23.2-arm64.msi \ +Windows 32-bit Binary: https://nodejs.org/dist/v22.23.2/win-x86/node.exe \ +Windows 64-bit Binary: https://nodejs.org/dist/v22.23.2/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.23.2/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v22.23.2/node-v22.23.2.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-aix-ppc64.tar.gz \ +ARMv7 32-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-armv7l.tar.xz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v22.23.2/node-v22.23.2.tar.gz \ +Other release files: https://nodejs.org/dist/v22.23.2/ \ +Documentation: https://nodejs.org/docs/v22.23.2/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +77c63032fd4ab8e98e0ae7db9d79e396659e04af95a5edf8e1ca869e426c04a5 node-v22.23.2-aix-ppc64.tar.gz +963c0f779d8f893f17f6b2a0060932c366ffa59f7c79527748a9c558c152dd38 node-v22.23.2-arm64.msi +61130f394c1630d211dd50aecc4353d379480f36d3ac913cd85dbba1aed585c6 node-v22.23.2-darwin-arm64.tar.gz +5eff7a9011895aae3f29d06f167b84a62b028a591370c7cafb59103559fd26e1 node-v22.23.2-darwin-arm64.tar.xz +58e99022c2ff89395576cc7fd4d98cea24bb68081475d5f88b801ee8729fb026 node-v22.23.2-darwin-x64.tar.gz +96dff79f4e19a78715da559ec7cac2028f4985a175ea0c3454625a269c21deb7 node-v22.23.2-darwin-x64.tar.xz +daaf13ec5d45a38bbcfcff06d0723f72a6813b89ab27bb5af2ac8e1f6259dde0 node-v22.23.2-headers.tar.gz +b141dcc466e2bc15bbc57602898915cf7b73bff974e72a357b1e2e3a4cfbd2e5 node-v22.23.2-headers.tar.xz +013b59cfd2819703a6f4a14ab891fc46fc2a4e3f5bcd92de3fb4929b43e35b30 node-v22.23.2-linux-arm64.tar.gz +fff4078c5def658577f92c88db7db3bc0072924bfb93fe52c1e744a54e94abb8 node-v22.23.2-linux-arm64.tar.xz +2a2f59eb8fd9dec27b3bee17c729131d1fd3e6d9943d479f1156ce38af8cd599 node-v22.23.2-linux-armv7l.tar.gz +ef8f26a3de19acd8c23548e6c3cfc2052610b0e67abb5fd64dbd92c8b1c1245b node-v22.23.2-linux-armv7l.tar.xz +65c8aa9e647196f30d3564bb6b201306b1b520f72f0dd3278da326014a018379 node-v22.23.2-linux-ppc64le.tar.gz +e2ba10110ad34096c051fe47134fcd12175ecc48e7e879d7d4c78b70cf66442c node-v22.23.2-linux-ppc64le.tar.xz +986b8441b1d1a01c70ed710bab201741fd0d196d302a7e4338fefd5e1c10e61e node-v22.23.2-linux-s390x.tar.gz +50aa0935c7caee2f95434f84c2c19f16e4f223257eadb341a3a2d5aaa545bbe6 node-v22.23.2-linux-s390x.tar.xz +b294a556e639d64338823920e5866c21c02741742d2e1529ee1a225c1ec9252a node-v22.23.2-linux-x64.tar.gz +d60acfe00a2932254bb0ad20e01b0d74397a0875595de719654b214f4b03f307 node-v22.23.2-linux-x64.tar.xz +0422d63395d28cad31d92a202b8a5ff76d3bf09f234786926622bde7fe2d7a89 node-v22.23.2.pkg +cdaed46fcd8923a55974b7bbc7caaadeaaf7aed60cc137e59837b72f575ef641 node-v22.23.2.tar.gz +bbe768df8d5815d7fa76124052985332452e0a4742d39f32027550d1aab8f6fb node-v22.23.2.tar.xz +f8bdc72090f0e13223c6b974cb0a2919be9650f27f45223df4bb78231df3fb7c node-v22.23.2-win-arm64.7z +fec025a6da31757e3b6af84c5a1628e9d38442ca99a2161091d78f2fcfa35ef3 node-v22.23.2-win-arm64.zip +4f72483c39634934c77b1ece25911d84d2a929d6171751ea701d13f348368838 node-v22.23.2-win-x64.7z +1177b4137ba5adaa56354ae40f1080c7450e8ae09cecb47da459d1c52ac99f97 node-v22.23.2-win-x64.zip +211b8539e37b4f0a31d11016bdb882f036b1f3bcd2da879f365e0d712d7973a1 node-v22.23.2-win-x86.7z +725c9e2bdd1c2016b41c995a81f4fa36ce4e2ee565b7455d8f889182727df647 node-v22.23.2-win-x86.zip +ce9572ae220c345fbae2340bbb4d084e8ca5e0fe093ee7067d43094ae23be989 node-v22.23.2-x64.msi +bacc6689c6b6953e120fedaf0bba9f16349bb2755f6ee9fecf33317daab9d029 node-v22.23.2-x86.msi +97cce5301a815d2dce07ac5bfd1e6039eae88185ec1d10ae4f8cb712f1732878 win-arm64/node.exe +e56e62f4a7ae6643a40db01f09072e8a93ccbe73be8abff927b793344691d6b7 win-arm64/node.lib +42263b4322f459ad5c665a1569e77a53125853f43069ded98432bbdb29378fab win-arm64/node_pdb.7z +9b1d825eebb86b58829d72ce3b0c28a84d80bf7e2204c835e1ec99a8729559df win-arm64/node_pdb.zip +0d0f5e39f9f3d9587bc19f73eab3c2c9c4903fd02d6dbf9c853dd81b3d95fad4 win-x64/node.exe +ac15f1e9d7c8279353723a77f6319967f1a41c06026521094a8234c2e6fbe052 win-x64/node.lib +bf6be5c7dae68227e6fd6a105aa5b2eb8b3511a6f1ab4488f27ce36b85d66f30 win-x64/node_pdb.7z +f5836a84ab8aa5ecf5e5e415cf8fa92c2b8fc11c3128e9225877c2628dd00318 win-x64/node_pdb.zip +ae3f4245f4b87a79b1a9f66fbede12f526adc3dea9c4bdb50d66ed8c88eb395a win-x86/node.exe +66949ba371a159f5e3626f6ce960f85ab6bcdd237eafcdfbc11d1377a2767652 win-x86/node.lib +754c6fa0c493d19baa93cccf25668637b48b46edb810f604034c87cf7a1c3ed7 win-x86/node_pdb.7z +65d6b0a8590eb1401bb6756d63b0ab12db3c31bc0ce71a892e3079c8fdeca305 win-x86/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iQJPBAEBCAA5FiEEzGj1oxBv9EgyLkjtJ/XjjVsKIV8FAmpqBnEbFIAAAAAABAAO +bWFudTIsMi41KzEuMTIsMCwzAAoJECf1441bCiFfLkYQAI5Lu6hHMJGYjWieVVc3 +izv4gfMxrwr4doLo4DTVywRE7ZdKd8ylgmWQ4lfHK4XAmRDnZfm5dMtK6xDRkqBi +AVAKIvBznIOvNMoCQvj8dKUqLTOpmTBS0chARWwq6WqQSUnTAfvejDHD7QEo/jYm +04mfdOFupcU/RnnBTlNLNMgye1F8owj2MjccvjRkA/ML7LSY7esYgLPfeulVY+k8 +VcJ1xcaIzr/tgbURyIxzfkmoY+urebvPAAsVGZoDBjMelUmX5xs1PXO+jy4uNMg4 +JT/qI3Oadn4OYkhNczWtaB4j5HhFxtkY8CFek8k1c+1XpWw1KvfbHMhd/O81Tq4W +hHFIeKyEYKG2DApAYDcfouPprknnC8gAp7xnMZvTHsdqWCxbgCXw24Der3t74KpS +FyIB1DhpL6x9cQ7gSWPo4SlThalUBJhqUDZIlnarafPzs2mywP4FeDlSwv/f44u0 +xpeP9BBjB3PoHGQ+MMDqpTNEBGZoo8pf3fmPwCv3W41LOiHy6Tce0NgLImCJXpaj +AxO0LL+BFEDr4qasfOMQkU+r2uSlPLdeSx7MLVziy4yLUF5WDKc5fdEJlxyhMA+5 +8AQY65xR+Jfrl9s3M7I2PYtN7+yzwvJrU+AhCDujSoxzWFII8aITKyrsrgJ+4Z4B +dTZJ6z2spVlbPqiFdhAGjbk8 +=TLBg +-----END PGP SIGNATURE----- +``` diff --git a/apps/site/pages/en/blog/release/v24.18.1.md b/apps/site/pages/en/blog/release/v24.18.1.md new file mode 100644 index 0000000000000..62d1858cbcb9b --- /dev/null +++ b/apps/site/pages/en/blog/release/v24.18.1.md @@ -0,0 +1,106 @@ +--- +date: '2026-07-29T16:19:07.684Z' +category: release +title: Node.js 24.18.1 (LTS) +layout: blog-post +author: Juan José +--- + +## 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol + +This is a security release. + +### Notable Changes + +- (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High +- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High +- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High +- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium +- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium +- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium +- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium +- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium +- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low +- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low +- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low +- deps: update llhttp to 9.4.3 (Paolo Insogna) +- deps: update undici to 7.29.0 (Node.js GitHub Bot) + +### Commits + +- \[[`6cb0475751`](https://github.com/nodejs/node/commit/6cb0475751)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) +- \[[`bcfe21d3dc`](https://github.com/nodejs/node/commit/bcfe21d3dc)] - **deps**: update undici to 7.29.0 (Node.js GitHub Bot) [#64713](https://github.com/nodejs/node/pull/64713) +- \[[`9d0d36cffd`](https://github.com/nodejs/node/commit/9d0d36cffd)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) +- \[[`8a008fb523`](https://github.com/nodejs/node/commit/8a008fb523)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) +- \[[`a77c7f7354`](https://github.com/nodejs/node/commit/a77c7f7354)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921) +- \[[`34ed88a069`](https://github.com/nodejs/node/commit/34ed88a069)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#63752](https://github.com/nodejs/node/pull/63752) +- \[[`95ba2cfde7`](https://github.com/nodejs/node/commit/95ba2cfde7)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904) +- \[[`fcbdbe47ea`](https://github.com/nodejs/node/commit/fcbdbe47ea)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930) +- \[[`ea26c12b56`](https://github.com/nodejs/node/commit/ea26c12b56)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911) +- \[[`9a6b7e343a`](https://github.com/nodejs/node/commit/9a6b7e343a)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926) +- \[[`6c0c990880`](https://github.com/nodejs/node/commit/6c0c990880)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927) +- \[[`af9ff0490c`](https://github.com/nodejs/node/commit/af9ff0490c)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896) +- \[[`05f541b5c0`](https://github.com/nodejs/node/commit/05f541b5c0)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931) + +Windows 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-arm64.msi \ +Windows 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-aix-ppc64.tar.gz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v24.18.1/node-v24.18.1.tar.gz \ +Other release files: https://nodejs.org/dist/v24.18.1/ \ +Documentation: https://nodejs.org/docs/v24.18.1/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +3c76240c07b9f03574a5cf8ed8ba19e8db89271943817b1a4b94de43c97a9e66 node-v24.18.1-aix-ppc64.tar.gz +c3897213475a089b526c8ffb5a84b0151d03eb2206d3e38aac44b2c053719b81 node-v24.18.1-arm64.msi +eb02f7fab96d3d67de40c5ec8566096fcb4c2026728787683ae5a97eb612b941 node-v24.18.1-darwin-arm64.tar.gz +1d60b703fe5d7e7072489be8187f430f1a095a658c31e5e1e281331a5873fac3 node-v24.18.1-darwin-arm64.tar.xz +6fb20fceacbb157c2f95825b80df4a454a0f6d81cdcd7bb81eeae9147e0e76ec node-v24.18.1-darwin-x64.tar.gz +f892c7895720f40d3750bde24f3554242d36f23602b5167b5b73ec4d13938aef node-v24.18.1-darwin-x64.tar.xz +bee7344a7fc6e3252c4822ca916a50cd6ddda9bb39374d6140a8046d9238fded node-v24.18.1-headers.tar.gz +38d44792ec2bee82aca52dbe166979a146f5e75e09ee35e0c0b017b8e2db7c48 node-v24.18.1-headers.tar.xz +df224555a083b918e46260cc969838501b9f9a87140c1195e5b9597b56d5dae2 node-v24.18.1-linux-arm64.tar.gz +7201e3a09dc825bac57867c81913e2b8f0ef87d04cb9082af4cda82f6ff3d88c node-v24.18.1-linux-arm64.tar.xz +4a8c6209ba3a5aea84c40201d896624ed706b9799a6dc54cbd965433a369a3d0 node-v24.18.1-linux-ppc64le.tar.gz +c47812c13862be7f6e71194c434c4d78a99096e72efb9c31a2627437e056d669 node-v24.18.1-linux-ppc64le.tar.xz +62ad850efefa9ab42a3e901d8e0de86d71bf9c8a0c389dabed248f1ec9590c5a node-v24.18.1-linux-s390x.tar.gz +acf57bd726f35afc2ba8475194e5a8bd532c00e1a3b2436295b2fbdde199d0e9 node-v24.18.1-linux-s390x.tar.xz +9f5eb6ac21845a66c493c91a253b1da32fd684e89e9b7202d4936982336be4ca node-v24.18.1-linux-x64.tar.gz +d6c664df3f3f61458e8c277585571328522d705166723a7c7823a9253a4d15a0 node-v24.18.1-linux-x64.tar.xz +c2e424f198dab39b5c68e8b06e0cdba9761dca9b5b432941fce6399d6460dabb node-v24.18.1.pkg +b62cd76de0a0a28dd9ff88580c92344bdeb008f21c1d7479c5d8659cd96ef4e2 node-v24.18.1.tar.gz +86d40d594bbdfcf69009a62fdf43cb19ae72b6cb5822d2bdd8349c5a1b2fa628 node-v24.18.1.tar.xz +8aed98bca9260716236be292807dcb2638827750ba2fbcfc684601a9a6b8ab48 node-v24.18.1-win-arm64.7z +ffbc7d3e1baf6804f7431ff94f19b9a885a650568c93ea4ccb1bb0038f6af825 node-v24.18.1-win-arm64.zip +365ecf84eeefb87a5a4c94f1e54919696cf5581285db4e589e84d46c0e167406 node-v24.18.1-win-x64.7z +ec56b84a7551893ab2324ebdfdc4ab974a63b4781162600b68a1293cc3e53765 node-v24.18.1-win-x64.zip +af4a0651a26f04ac240f00fec872f305547ca2aa56301c41dfd63a29eb2ab836 node-v24.18.1-x64.msi +845fc4ce00780241667f92e8f7a3a679321a655dddb3b610f2d85693b17ddf28 win-arm64/node.exe +7da03c5111815b69bbe63ffd2e51b28cd69eec9f545b7ccb8756efffdbb88dc2 win-arm64/node.lib +86a5fa89be9c19be42864edfbc2721931fa3c5b318c0f5cd7c1b5c0f49c1f259 win-arm64/node_pdb.7z +0e085f6058961484fb7e93a35ccd0b1ff02efed7bfe1387203097614dc9864a2 win-arm64/node_pdb.zip +ac51903c4c111815d52280b1fdcc8da067cbb37e2fe1a765097b85c3292c8582 win-x64/node.exe +589684168a73547ca47cd22d76a4e465ef561abe89fb1b2b23fe35bbe857d505 win-x64/node.lib +50155c3c9afe1c3ce9a57a8763ed421acc72845c2d30f79d93afe73cb65473ef win-x64/node_pdb.7z +a9970c87747af4ef15524240dc28ebcf64080c7a68e39d2a406b743e438b6a20 win-x64/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iHUEARYIAB0WIQTdeS9Zc8beUsQyy9rHer+gDdvytwUCamomTgAKCRDHer+gDdvy +twyzAQDrLBWmNsaCn+z0wLyVZgHGA4R5wjJcIil2aKvsiiwDgwEAosTcDL1Me9tq +sDclFViJ4DaRM2efOzyjeLKf/qKH+go= +=4N8e +-----END PGP SIGNATURE----- +``` diff --git a/apps/site/pages/en/blog/release/v26.5.1.md b/apps/site/pages/en/blog/release/v26.5.1.md new file mode 100644 index 0000000000000..c49f6799f01c3 --- /dev/null +++ b/apps/site/pages/en/blog/release/v26.5.1.md @@ -0,0 +1,111 @@ +--- +date: '2026-07-29T14:03:39.312Z' +category: release +title: Node.js 26.5.1 (Current) +layout: blog-post +author: Rafael Gonzaga +--- + +## 2026-07-29, Version 26.5.1 (Current), @RafaelGSS + +This is a security release. + +### Notable Changes + +- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High +- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High +- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium +- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium +- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium +- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium +- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium +- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low +- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low +- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low +- deps: update llhttp to 9.4.3 (Paolo Insogna) +- deps: update undici to 8.9.0 (Node.js GitHub Bot) + +### Commits + +- \[[`af0bf96877`](https://github.com/nodejs/node/commit/af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) +- \[[`0354678355`](https://github.com/nodejs/node/commit/0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](https://github.com/nodejs/node/pull/64712) +- \[[`dbeeaeec13`](https://github.com/nodejs/node/commit/dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) +- \[[`064d339f56`](https://github.com/nodejs/node/commit/064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) +- \[[`23b94c843a`](https://github.com/nodejs/node/commit/23b94c843a)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921) +- \[[`c7ec3dc0b9`](https://github.com/nodejs/node/commit/c7ec3dc0b9)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904) +- \[[`8f666925b1`](https://github.com/nodejs/node/commit/8f666925b1)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930) +- \[[`ad99d075b1`](https://github.com/nodejs/node/commit/ad99d075b1)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911) +- \[[`61222008b7`](https://github.com/nodejs/node/commit/61222008b7)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#908](https://github.com/nodejs-private/node-private/pull/908) +- \[[`3cb607dfc4`](https://github.com/nodejs/node/commit/3cb607dfc4)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#924](https://github.com/nodejs-private/node-private/pull/924) +- \[[`d08fde8a16`](https://github.com/nodejs/node/commit/d08fde8a16)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896) +- \[[`b3fbb6e11f`](https://github.com/nodejs/node/commit/b3fbb6e11f)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931) + +Windows 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1-arm64.msi \ +Windows 64-bit Binary: https://nodejs.org/dist/v26.5.1/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v26.5.1/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-aix-ppc64.tar.gz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v26.5.1/node-v26.5.1.tar.gz \ +Other release files: https://nodejs.org/dist/v26.5.1/ \ +Documentation: https://nodejs.org/docs/v26.5.1/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +0bafe816b17bcaee285e79e325b7a44eea605d12d81b2caa78cddcadf5d1b5f6 node-v26.5.1-aix-ppc64.tar.gz +01875f52263953ad81972d304263f36a71e5e97873fa9fa60989e8973d18d00b node-v26.5.1-arm64.msi +f4387df0b46556516d19abf2f2d6806481ac8368aa7f9d96bafed422a56a1d01 node-v26.5.1-darwin-arm64.tar.gz +f4665a1e764653ec6fe7686309e8907e9ebb9ba68c4b88b9185fdc29f221559b node-v26.5.1-darwin-arm64.tar.xz +077d5c936868dab19d21f77f1e71ce13697e80b3e86a399dcab238902a2ebf93 node-v26.5.1-darwin-x64.tar.gz +4436be8db0e2bd5ca3dee8c48aa8a157c9a8fef99580036ff1da8ef6aba44708 node-v26.5.1-darwin-x64.tar.xz +598a3139679db65461f8af50463d668008eaee5e0d09df4eeaa27f3eeefecc03 node-v26.5.1-headers.tar.gz +f72d24a5a34b40ba738f6d28cdcd50e3f4976558d4f14bebfa64fdbdcfc4951a node-v26.5.1-headers.tar.xz +21194bbf41c18d9ec277545c4d14cce8597d57a9d9f494c323d8121a25de33e8 node-v26.5.1-linux-arm64.tar.gz +0b6b0cc2a1eecbe736f9918de8b5a6c9a48d286b88bec1298a3c1e3376182ea8 node-v26.5.1-linux-arm64.tar.xz +cf518dd2772ea7e5046daf4a4ba9e348fce01e2b9741f32ba21b4bbd87b8dfaf node-v26.5.1-linux-ppc64le.tar.gz +692d0c45896bf232e22b8b64a4a826ed0a70fec75545f208d120c109d0a86752 node-v26.5.1-linux-ppc64le.tar.xz +af5a58fca0c3fc130c6a649bd6c29f4b000145055eb7a364bde189abdf1516f5 node-v26.5.1-linux-s390x.tar.gz +ff4635062f82308dda7c7164337ad9bb383568dac984ff64b35b888e7d7a4ef3 node-v26.5.1-linux-s390x.tar.xz +2b07f09c218d473a26442bff5a90151f53f7b7c0a23bad244eda2c26303a2ba7 node-v26.5.1-linux-x64.tar.gz +cc7b3484ade63bd203a9d304f21ec37a3b622b988d7bdecf1dc4d68fc44a91b7 node-v26.5.1-linux-x64.tar.xz +a6e6cfdb0af6d7d68b50a6f663b8ff321923089309076ea7943a19dbe5eb662a node-v26.5.1-win-arm64.7z +467f425228a2fdcc83a330f5f38b124b5b43b42f5033d7848b4e47c9becc36f9 node-v26.5.1-win-arm64.zip +0c8a1a3604e57400432089cf7e179eac4f25b26445a156aaa98cca5619e50f5c node-v26.5.1-win-x64.7z +c432c996b95cbf7568f13a0fbb37526de84a27e3a5c520c3be15f05a9a168212 node-v26.5.1-win-x64.zip +826a4551bb9d3c00c61c17a2521a1e901ac7304e3090a3c2d07c1e0fe2b4d60d node-v26.5.1-x64.msi +ae175856e12aadc081a539af37a70a71d3233b2e710fa00266137e23e24faca2 node-v26.5.1.pkg +1143281232fc4640188aaa20afb0f9c4f06031f554cd3f1e5ac86e8a0387511a node-v26.5.1.tar.gz +df7770a9a99346f8b73ba6d31ad89bd6f868b51c7387c3627dcb44ca065f4948 node-v26.5.1.tar.xz +c6ca33154ee426f46e02aa9f5676d69b768808b564aa22652fe18bb08c188fe5 win-arm64/node.exe +c01ce0d5e4e956f0e5e73cdba925d15a6d6f86883aa49f8f0b0de87aa93508ce win-arm64/node.lib +83961c8a59f1771a2e0ffcf89487b3fa0a7ca18a69f1061683c27671b36665e5 win-arm64/node_pdb.7z +7b40fa280b35d3aef700852220075f262a25c4cdd9a6f90fb8a3a4b1bed9cf8b win-arm64/node_pdb.zip +b48b0224081224cda1f49374e2fc63d143041ade51754f0cc6608fe8510ba29e win-x64/node.exe +56f06350037085fce04930befd98327afc86ee46f52af6f6f8a68a03630e8380 win-x64/node.lib +cbd18315c40cb831d1a398c0df64a43876999e77eb56b52589b64ee8a5bf93d0 win-x64/node_pdb.7z +fb3b232e033a25d0aae20c0413589569688807471e98a1620ef7f7ec959fbf83 win-x64/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmpqCAYACgkQi+q0389V +XvRsRwv9Gscq3A1VqXWzAWdyE+tWyMGYTSzisHRRudAmDVkUoEK/WHfgmbmFXXDC +IjokChhRdJL4I3DFSq8sntybzGMYb1hqwvPRr9fRCW+6dsVT1eNnb8OQWObqONaq +w8F82T+mSk8D4ZSH7Q9IMGBZBzln3oRBwXuHOUcYMtnMEKgHsP35Li4HARaKWMGE +enlNvp+r9PxHMKXtKl5cFygqh0slhEHJQ/6GzKKNRbSFTpEBkQbtIEaFib7XHguv +6uUj0R0ZhCXrcYzlxhL6KIGHes0jMIRwkM9C3b7Q2c9Jw0PuglhCPdD+VZI1dIU6 +7j8f/jyncIZMXE5FNnldwMy9aiA/xcOenTEA/F2yBEM+ErrWf8r7tLQk0JfqmZ1M +qfqHHb2zu2ywcHspOS6Lhn+1wE47rEKAdYYt7iRA4L86TASCie1K8hgrsIJE5z5D +dv02pgX3Oj2hLsCun3PfH6a0MSYXIDCwelz3wn8uWl5tN8pH4F0eLZWJ04sjXvdb +ySj7vo4t +=wksr +-----END PGP SIGNATURE----- +``` diff --git a/apps/site/pages/en/blog/vulnerability/july-2026-security-releases.md b/apps/site/pages/en/blog/vulnerability/july-2026-security-releases.md index f5a7dbecc499e..47911a287d7f6 100644 --- a/apps/site/pages/en/blog/vulnerability/july-2026-security-releases.md +++ b/apps/site/pages/en/blog/vulnerability/july-2026-security-releases.md @@ -1,12 +1,162 @@ --- -date: 2026-07-21T03:00:00.000Z +date: 2026-07-29T00:00:00.000Z category: vulnerability -title: Tuesday, July 28, 2026 Security Releases +title: Wednesday, July 29, 2026 Security Releases slug: july-2026-security-releases layout: blog-post author: The Node.js Project --- +## Security releases available + +Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the +following issues. + +This security release includes the following dependency updates to address public vulnerabilities: + +- undici (8.9.0, 7.29.0, 6.28.0) on 26.x, 24.x, 22.x +- llhttp (9.4.3) on 26.x, 24.x, 22.x + +## HTTP/2 retained headers can bypass `maxSessionMemory` limits (CVE-2026-56846) - (High) + +A flaw in Node.js HTTP/2 handling can let retained header blocks evade `maxSessionMemory` +limits and cause remote memory exhaustion. + +Impact: + +- This vulnerability affects all users in active release lines: 24.x, 22.x + +Thank you, to leduckhuong for reporting this vulnerability and thank you mcollina for fixing it. + +## HTTP/2 re-entrant send can cause heap-use-after-free (CVE-2026-56848) - (High) + +A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. + +Impact: + +- This vulnerability affects all users in active release lines: 26.x, 24.x, 22.x + +Thank you, to hahahkim for reporting this vulnerability and thank you mcollina for fixing it. + +## Permission Model path matching can over-grant filesystem access (CVE-2026-58043) - (High) + +A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. + +Under `--permission`, an attacker who is granted access to one path can abuse +radix-tree prefix boundary handling to read from or write to paths outside the +intended filesystem allowlist. + +Impact: + +- This vulnerability affects all users in active release lines: 22.x, 24.x, 26.x + +Thank you, to sy2n0 for reporting this vulnerability and thank you RafaelGSS for fixing it. + +## HTTPS Agent can reuse mTLS identities across PFX certificates (CVE-2026-56850) - (Medium) + +A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. + +Impact: + +- This vulnerability affects all users in active release lines: 26.x, 24.x, 22.x + +Thank you, to yottt for reporting this vulnerability and thank you RafaelGSS for fixing it. + +## HTTPS Agent session reuse can skip hostname verification (CVE-2026-58040) - (Medium) + +An incomplete fix for CVE-2026-48934 has been identified in Node.js. HTTPS Agent +TLS session reuse can skip hostname verification across identity policies. + +Impact: + +- This vulnerability affects all users in active release lines: 26.x, 24.x, 22.x + +Thank you, to vnyuh for reporting this vulnerability and thank you mcollina for fixing it. + +## `node:sqlite` SQLTagStore iterator replay can re-execute writes (CVE-2026-58041) - (Medium) + +A flaw in `node:sqlite` allows a stale `StatementSyncIterator` created through +`DatabaseSync#createTagStore()` to continue executing a cached prepared statement +after it has been reset and rebound with new parameters. `SQLTagStore` resets +cached statements using `sqlite3_reset()` directly, bypassing the iterator +invalidation mechanism introduced for `StatementSync` in recent releases. + +Impact: + +- This vulnerability affects all users in active release lines: 26.x, 24.x + +Thank you, to cantina-security for reporting this vulnerability and thank you mcollina for fixing it. + +## `dns.resolveAny()` can abort on DNS responses with many A records (CVE-2026-58042) - (Medium) + +A flaw in Node.js can cause `dns.resolveAny()` to abort the process when a DNS +response contains more than 256 A records. + +Repeated triggering of this condition can lead to denial of service. + +Impact: + +- This vulnerability affects all users in active release lines: 26.x, 24.x, 22.x + +Thank you, to cantina-security for reporting this vulnerability and thank you RafaelGSS for fixing it. + +## `node:zlib` sync APIs can crash on spoofed `TypedArray` length (CVE-2026-58045) - (Medium) + +A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the process to crash. + +Repeated exploitation of this condition can result in a denial of service. + +Impact: + +- This vulnerability affects all users in active release lines: 26.x, 24.x, 22.x + +Thank you, to byvini for reporting this vulnerability and thank you RafaelGSS for fixing it. + +## Permission Model allows trace events to write outside the allowlist (CVE-2026-56847) - (Low) + +A flaw in Node.js Permission Model enforcement allows +`trace_events.createTracing().enable()` to write trace logs outside +`--allow-fs-write` paths. + +This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. + +Impact: + +- This vulnerability affects all users of the Permission Model in active release lines: 26.x, 24.x, 22.x + +Thank you, to 0xoroot for reporting this vulnerability and thank you RafaelGSS for fixing it. + +## Permission Model allows process reports to write outside the allowlist (CVE-2026-58039) - (Low) + +A flaw in Node.js Permission Model enforcement allows `process.report` to write +and overwrite files outside `--allow-fs-write` paths. + +This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. + +Impact: + +- This vulnerability affects all users in active release lines: 26.x, 24.x, 22.x + +Thank you, to sinan-polat for reporting this vulnerability and thank you RafaelGSS for fixing it. + +## HTTP parser header truncation can enable request smuggling (CVE-2026-58044) - (Low) + +A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. + +Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. + +Impact: + +- This vulnerability affects all users in active release lines: 26.x, 24.x, 22.x + +Thank you, to yushengchen for reporting this vulnerability and thank you mcollina for fixing it. + +## Downloads and release details + +- [Node.js v22.23.2](/blog/release/v22.23.2/) +- [Node.js v24.18.1](/blog/release/v24.18.1/) +- [Node.js v26.5.1](/blog/release/v26.5.1/) + ## _(Update 28-July-2026)_ Security releases postponed The Node.js project is delaying the planned security releases until Wednesday, diff --git a/apps/site/site.json b/apps/site/site.json index fc1de44c333b1..4e63228b157a2 100644 --- a/apps/site/site.json +++ b/apps/site/site.json @@ -28,9 +28,9 @@ ], "websiteBanners": { "index": { - "startDate": "2026-07-21T03:00:00.000Z", - "endDate": "2026-07-30T03:00:00.000Z", - "text": "New security releases to be made available Wednesday, July 29, 2026", + "startDate": "2026-07-29T00:00:00.000Z", + "endDate": "2026-08-05T00:00:00.000Z", + "text": "July 2026 security releases are available", "link": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "type": "warning" }