Node.js 22.23.4 (LTS)

Antoine du Hamel

2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95

This is a security release.

Notable Changes

(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
deps: update timezone to 2026e (Node.js GitHub Bot)
deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
deps: update undici to 6.29.1 (Node.js GitHub Bot)

Commits

[68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
[dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
[a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
[ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
[a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
[67d294739f] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
[1ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
[52b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
[60f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
[05470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
[47333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
[98258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
[a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
[e9e295bcc1] - deps: cherry-pick e807d4e379 from SQLite (Junsu Han) #63525
[512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
[e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
[857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #66765
[19c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
[e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
[50ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
[a18ec92752] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
[4342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
[d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
[beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
[4b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

c219410bea0aed08ecfa5847a3d8aca4e45dd494a094f86c0d8721138360a9c9  node-v22.23.4-aix-ppc64.tar.gz
49edbb15812c13efa061c2c76b06944425f3711454845e78b625a8e865a45327  node-v22.23.4-arm64.msi
c9e1dbc748b33ed2d14f42445191ecaf14c56259c7a9a26d0042c49ec2b66428  node-v22.23.4-darwin-arm64.tar.gz
037650d0839f457747396f052073fb48333d31bf5abd3c98b74da20d89ebb1ad  node-v22.23.4-darwin-arm64.tar.xz
efcc2b0db6f94bf53eddb038fe2b370277a042bd29e4f19b8f8e23598795b819  node-v22.23.4-darwin-x64.tar.gz
f42abca7aaac61efc57d49fb42ea84fc53bbeba9a749cb03a291ce6e4e7a69c1  node-v22.23.4-darwin-x64.tar.xz
dc4028dc105e27e5295119dd9da076fca71d5216113e097813f0fb30f59241a5  node-v22.23.4-headers.tar.gz
00615892b14ca159775ccb96d5696fdfeeea9804740fc8c5c1064eac09456a0e  node-v22.23.4-headers.tar.xz
f7a1e486dbc8b286847815b477d4fb5e9fb963ed4489c3e1588853d685f589f9  node-v22.23.4-linux-arm64.tar.gz
6287aa46b6c375d816e63ae66d024fbbfd70404825aabdfdf898a970871d2f4b  node-v22.23.4-linux-arm64.tar.xz
4318e0c68f62e18583dae85eb645f55c7f2b8a2e8d1fffe91a2e8abd046880ab  node-v22.23.4-linux-armv7l.tar.gz
c9057c6a3b8fbb9651ed115c1e96d4a7281b7b9c9ca89fa05865c98ed7ffd437  node-v22.23.4-linux-armv7l.tar.xz
6684903ee2795aafe639dc07203e8a51ed20ae161cf21b6da7c213c8abfed442  node-v22.23.4-linux-ppc64le.tar.gz
e4732f45e0cad787d6ba70c4eb6db45dbdb3f286f67dee429dbc6b4ff36eac43  node-v22.23.4-linux-ppc64le.tar.xz
0bdc80fa27331e7f416d1d8553b9aabbc3c158709dc32859e4e85724ac1ac302  node-v22.23.4-linux-s390x.tar.gz
07ae074fc218fc42e24c939df0dc0209443fb08eb5b2ed6d26b1bf6757781fff  node-v22.23.4-linux-s390x.tar.xz
63189402eaa222aabf51b4983e512592131cd2d4a9efc3ad9bf291fe74e3e4de  node-v22.23.4-linux-x64-musl.tar.gz
38355b952f0392b91703d38a0d9af84eb0ff77d69828ca4bc8cc3bc3af80a720  node-v22.23.4-linux-x64-musl.tar.xz
b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406  node-v22.23.4-linux-x64.tar.gz
1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce  node-v22.23.4-linux-x64.tar.xz
2095e4e478f01cfc1cd3784482bbb5bc67feab9bb21336b8934718bfc0f3b435  node-v22.23.4.pkg
4dd79de8cdc85d65cb32f48a75aee1067bf00bf94b96ecc8e4c2f82f6f0272c2  node-v22.23.4.tar.gz
7b9adc82d612d0a2a863d96c46de2292552e250cee51956ebbe0146c42aacae9  node-v22.23.4.tar.xz
a31b4be40d29f457dcd818563f2a3cf77f1ca35a15d3477cab38b3cc6d3a426a  node-v22.23.4-win-arm64.7z
a8b8cd79cbbb3062435f449591d98dd63730bbbf30ce2d7cc3a6376c236cb111  node-v22.23.4-win-arm64.zip
010e51ccdd453d747ca67bfe8dda2c5da82540fa896ce2527f286d549574f975  node-v22.23.4-win-x64.7z
cbc74b5e0982c9dbb41525fd8fb5dcd32fbee237863f7829072f4639a1ce5f20  node-v22.23.4-win-x64.zip
b393001b81f7d478863394692bb57d28c0afe399fabbab3bce6016bb1cfa181f  node-v22.23.4-win-x86.7z
7d6c4dce2ecccca46e3c4b3e43c8bebbd1969bd616fdb4fda1e8269171d9ccea  node-v22.23.4-win-x86.zip
ca9303d3a12e8bec6de829fcb7812fc776930e0ce5c030328a24984ef928427e  node-v22.23.4-x64.msi
c2a76d76eda52b7930b51fd490264c2fe34a094c04ae721bb71893f3fd6cd1d0  node-v22.23.4-x86.msi
64d9f6e69b4703870e8cd30a3477127df8b683ea04feb03660e439396549042a  win-arm64/node.exe
5378f5bad777b4929d1cd4f58974e0ef03815ce5c159863f1875c4b434460c27  win-arm64/node.lib
8ad8a3ad402d8cf3bc760bf8ad03c85996ae6676a93407b6f06320ef5e981387  win-arm64/node_pdb.7z
4f94c9c8ab6a3ca4003e41ae226f191cb9ae837312d1390c14db94771a5abc94  win-arm64/node_pdb.zip
dccc52de28d8df2ee22d2062424f8c563070d95d8ad70c54c4bf01d590dec14f  win-x64/node.exe
c243185f2347870cadb637c909bf123fc703dc65dbfa769b17ec45a4b661d782  win-x64/node.lib
c8496e103ee832fb8daf21af22b418c88558956457b9d850e95f78baf7f779cd  win-x64/node_pdb.7z
426d3e46b15a918c561a15c2c99610d8edac752a406cf0b573809add0ff96f5d  win-x64/node_pdb.zip
aa39a7741f62832ea50daba0113c8f8b12ccde226abca931326832d5bc47d31f  win-x86/node.exe
eff47cc18fe2d3e40886cd49f04a85134681657d8b0f2afc55f363743cf6ddd7  win-x86/node.lib
2f5fcf07c631cff056ba53d4d8fb71d33d6302e243b7b267bfe3e226a3d76193  win-x86/node_pdb.7z
8aff266913d43a87103ebe02a4631148491b987ac2f70c6f3c95cf7e160de264  win-x86/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCatiU6AAKCRAgsaOQsWjT
VnXQAQDr+PrTYZtsgzxkf4LjsVlHCaVc9S8q5J1wHIcaNniLrwD/SCaZV98GQixc
dMdWJU0vUeZgB8Szb/eD1b3hcZmG3AY=
=vuXb
-----END PGP SIGNATURE-----

Node.js 24.22.1 (LTS)Node.js 24.22.0 (LTS)