Node.js 26.3.1 (Current)

Antoine du Hamel

2026-06-18, Version 26.3.1 (Current), @aduh95

This is a security release.

Notable Changes

(CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
(CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
(CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
(CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
(CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
(CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
(CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
(CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

Commits

[98fbc89211] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
[110840f2c7] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
[8d36d522b2] - deps: update undici to 8.5.0 (Node.js GitHub Bot) #63903
[2e6d03993a] - deps: update undici to 8.4.0 (Node.js GitHub Bot) #63779
[5a17d5b07a] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820
[362725d4e5] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820
[bd1214ab01] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
[bc0b53813e] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
[87d847bc70] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
[9308084fcb] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
[a67dd46891] - (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) nodejs-private/node-private#885
[7057c3f16c] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
[6bc17a6b51] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
[c8668beff8] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
[d1be630415] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
[a14c158bb3] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
[ebda73470d] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

8c0ef7465b17c31d6bfaea84d5b8d62944b543dcd2df42933aa0bff4771ebc5c  node-v26.3.1-aix-ppc64.tar.gz
bd0c50afcc7140b64b12e24f73f0681d68f84205575893561e6344dc09b71fc7  node-v26.3.1-arm64.msi
3f624ab0d774553c0d28b968e141d8c676a35a2811fb0b7b356ba9cbdce15f74  node-v26.3.1-darwin-arm64.tar.gz
49aca22a8c2992c16688baa512a7b00c41a4608e9675fcaa81534767bf1116ce  node-v26.3.1-darwin-arm64.tar.xz
3ec9e5a28c641c088f3d04ad38721bfdedb2f8aa8c031979fa93df08b5a92e58  node-v26.3.1-darwin-x64.tar.gz
dac58e340c721332d331a44c9ee2e126b26632c42d3028eb2ceb5c3f218798fa  node-v26.3.1-darwin-x64.tar.xz
a0fbaa7136174fa7533f6178c2331ffbaad5f25e9fd2e610fc3961b57fd5acae  node-v26.3.1-headers.tar.gz
e84075cd1296f089ad17bc87d34cea964bad7f1018378656af16d494adf91d1a  node-v26.3.1-headers.tar.xz
2f0829b201e9db20996ae15bce62138df1e3d317775b005778b05cf7b19714f1  node-v26.3.1-linux-arm64.tar.gz
c021380e64d1314d1218ab1f31e0f5b0f28f1f54ac779ef72a16c2bda0ca5c30  node-v26.3.1-linux-arm64.tar.xz
276d72c00b4cfedf3bc45bde6d1bd0a18e8c846ed150a5381c528112fa0ccabd  node-v26.3.1-linux-ppc64le.tar.gz
ec83deb41569e3896e8c4af4986c76dc0bf4e0eb909643b364d38e8a9f9f9091  node-v26.3.1-linux-ppc64le.tar.xz
740d35affe20683d244e494e0cc9710a91c1c6039ffdd0ed9f7d110c998bd23c  node-v26.3.1-linux-s390x.tar.gz
e8aece0730dc3dc808d66f8a8b8a6f87354ac941dfaa3a59a27022b2435abbcd  node-v26.3.1-linux-s390x.tar.xz
e892cd615e637edebcf22f9653d80fba63167ad6754d20881fd52cc37be81441  node-v26.3.1-linux-x64.tar.gz
55647180e4ae58ffeaa3294e89aa4abda7c371dfbd64b44cbdb022980177aae0  node-v26.3.1-linux-x64.tar.xz
40e8d2ad0a4f543c5e283ca0074ce8ea327062d448bf84f3cdfda27e736fbde8  node-v26.3.1-win-arm64.7z
021eb7de1d5257b24765f292dfcb469ff1528c29d88f48c875befb28114fb0fb  node-v26.3.1-win-arm64.zip
35c2ce21f7b0ea776b139cecc052641653abc31fb438cb17d096af7a9277d706  node-v26.3.1-win-x64.7z
45001b289ebffe7b22260898f3750059183d8246042b88e8ffa4337e65e6763e  node-v26.3.1-win-x64.zip
c07b05c3b9e22e1a408e630285f15201b86eaa32f5d9ca8cf35132c9caac0cf0  node-v26.3.1-x64.msi
942790eea681d9fa92b7c67343a2fd862b860546ad62f3a8a12f8ca72b784baf  node-v26.3.1.pkg
d38ec1c76d2651d2c597cffa46c8379b29e42baa5b82b7997981e8301b4b3387  node-v26.3.1.tar.gz
979b9b8308a8d2d4a27c662ed50448c85f970c0fd4f5ce8b98e8da78c441f2bc  node-v26.3.1.tar.xz
b8ad851e5ac8cbb784633ec905bd86a282697cc73eb1836c503f02968c7d2c41  win-arm64/node.exe
bd474f1ca8c44b2ab10e908c14447c5d91e1bac3f3a4d3141c78b6dbb5d1a253  win-arm64/node.lib
4ae86b1181dea3cf5a39c17600eec672df3b4d728643be91e3f6b3f8b9da6138  win-arm64/node_pdb.7z
8a256841ab4992714d817f8f15722f1db25520555823b4a9a6a6c75f86d44f17  win-arm64/node_pdb.zip
2e5b4362a7ea3478cb408a07189c19c16e487f188ac96db2e9e0f45ad8e21837  win-x64/node.exe
2f71186cc7649a7406b1616566700e397e9dd52bd7267440d78d78a1725bd312  win-x64/node.lib
e56e13c1a622751a9024b3d6e2c8806e992cd7f502bc3b22f47d7a471cdaee20  win-x64/node_pdb.7z
9dd4250f30eaf002777b719af182917c16ebb174b72a15575b5e81a93c1c989b  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCajN11AAKCRAgsaOQsWjT
VgK3AQCiaZF1iVzuLrCodtoLumgZJqaNBJFuc+DheHSVx91waQEAoowJe+hn+Kx1
QRMAE1Eeb+Y8eH6UYaDP6ACMbGUiGwM=
=UJVW
-----END PGP SIGNATURE-----

Node.js 24.17.0 (LTS)