Node.js 24.22.3 (LTS)

Antoine du Hamel

2026-11-11, Version 24.22.3 'Krypton' (LTS), @aduh95

This is a security release.

Notable Changes

(CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
(CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
(CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
(CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
(CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
(CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
(CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
(CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
(CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
(CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
(CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
(CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
(CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
(CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
(CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
(CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
(CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
(CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
deps: update brotli to 1.2.1 (Node.js GitHub Bot)
deps: update llhttp to 9.4.4 (Antoine du Hamel)
deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
deps: update undici to 7.30.2 (Node.js GitHub Bot)

Commits

[4c12b8a775] - build: respect OpenSSL's configured API level (Filip Skokan) #66953
[5654932a7d] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
[e88009c61c] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
[92e8d82e0e] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
[4164b5c2b4] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990
[4fec855b1d] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
[17c9eb75f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
[57ebbdc275] - deps: update undici to 7.30.2 (Node.js GitHub Bot) #67273
[8749030ae5] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
[8e100ac90a] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
[03f040685b] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
[7be19aa614] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
[ff8938913b] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
[ae9ab37d62] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
[a081fd3a3e] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
[22f4367981] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
[4f60230182] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
[fdbc6ab7ac] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
[d13a284de6] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
[c3485f2417] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
[599ca08e28] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
[981d2defc6] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
[799abe55cb] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
[45e3b1637a] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
[25d487e3da] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
[e14e27b8d3] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

693fe88c4a85e7e172ec132f760e67b3925b2d6442cb1cb3a74b73fcf831f70a  node-v24.22.3-aix-ppc64.tar.gz
6f36bfd098e103dc221ef9632c470a0879be88096c542d93c8802146d028da77  node-v24.22.3-arm64.msi
ff6e17d4874b76d272212b908cc020d6e815fba5a6c7eaaa06add725840307fd  node-v24.22.3-darwin-arm64.tar.gz
1d64136c8a43d648d1b3bad10797a4c995b1ca032d2bde8799de43b37f058fe5  node-v24.22.3-darwin-arm64.tar.xz
977614af0504c81045e7fd85596dbca0e5f951b96681516dadafedcca8c447f7  node-v24.22.3-darwin-x64.tar.gz
4daeec962855c1a6e66cda398a25037319dc1bbd4a0939188b3547afbbfb6490  node-v24.22.3-darwin-x64.tar.xz
bc93bde109befc916a62348caae708a48f9550150d786398fea2d773607c18da  node-v24.22.3-headers.tar.gz
6d99d3d799bd4c3807162e1bffc94749b723b65218e0328cf4e36262f9f8c4c3  node-v24.22.3-headers.tar.xz
261af2af250dfd7e9f25cf151d1b2713a0adf8f10a9ad116c4947f68627affe8  node-v24.22.3-linux-arm64.tar.gz
6e51a2ada00f0011cc266f65d98922b403d7ad88f809ca2aa615a5fe1ce6e86c  node-v24.22.3-linux-arm64.tar.xz
ba4b26ade1f7b3f5ba6756856815de58e353746004e7e46cc838243a6cbf3299  node-v24.22.3-linux-ppc64le.tar.gz
c4b446699171f64763304a0bc6fb972b0fb4acb1de5358e52b4c52a95883593a  node-v24.22.3-linux-ppc64le.tar.xz
d8f84397c1478c0ed0c1b29343626ed0f5f1a0985df0c5975c30f0c03836631f  node-v24.22.3-linux-s390x.tar.gz
b5dbeb563ffb81946478fd765ae92efc21117e410e4e9b7d966bf59b00cee55d  node-v24.22.3-linux-s390x.tar.xz
5499b663f62c72093715da98f4aea6f83427ad8bab9cf9c75f0924e0e456ce14  node-v24.22.3-linux-x64-musl.tar.gz
601b3e1930a593f3d44af2d0dca978dad4bd8b4594c4f8268b67a33553b04c30  node-v24.22.3-linux-x64-musl.tar.xz
061ec3e3062115705b56b51fa9cc330ab50d34b6969387d4e4b1a50c6809acc2  node-v24.22.3-linux-x64.tar.gz
4f2b175a6d53a5c617a80dba2676238a0688cef28c6da4eba35c7d844e66fcfb  node-v24.22.3-linux-x64.tar.xz
0924690f44874cd8eff3ea0d436564c006fba207a76b567d6d4f3dbfdba9fd04  node-v24.22.3.pkg
4690edccae352134bbe31d844b37898f2a28b2c3d67901d0112fb6c4996d556a  node-v24.22.3.tar.gz
48ca3aa8a9b02133356922ef4fc80200e00598c80a4ef446f7c39a459222593d  node-v24.22.3.tar.xz
016edd23a1aaece30a2fe71bca92b46267db54ab83994f0fc77746aa60af29d2  node-v24.22.3-win-arm64.7z
b3cc74a295b39d4f273271e96f58c06dd2b35757ca12abec64c7d0598b434f14  node-v24.22.3-win-arm64.zip
e15e37b60cca7eeadad76e52515a19729c91fe7f4ed3dc3299ac66ce9dc940f7  node-v24.22.3-win-x64.7z
e612af99f626ab415ea225af6bce5c971feb448cb5cae250bb1c3fa50c5f7d9f  node-v24.22.3-win-x64.zip
4a1ab5bdec5434bae58efae6c3e5077a011f6f1e76d2b47b7b10af043f7db545  node-v24.22.3-x64.msi
172e320db179ce416fc012b96b9917dacfb442beb081de57c4deaed7b5a24644  win-arm64/node.exe
2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d  win-arm64/node.lib
9cb6f5186a808c153a46896843c9a5de91b57196aeb3825433a0e159be91518e  win-arm64/node_pdb.7z
2939ce2c03c1ceee984eaf3b1d3c426781c5c968ed490a57806b2666b0ab0447  win-arm64/node_pdb.zip
86fc4785327db5f5c7558dc6156c543b433c313e813a222e088086222ab4afa6  win-x64/node.exe
a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7  win-x64/node.lib
96a5854ab8dc802a05418535a3ee89e50f2ae398a90e51a93f83b68e0ede902a  win-x64/node_pdb.7z
f4324467a5dcfbd66eef4263a13ac4075ca745bf2e8347bfff464951ba644ac7  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSaYgAKCRAgsaOQsWjT
Vv1pAP0bbPdYX8eujI8bGUA6hOUKT8e7rc6cmMiFwGCkZp1K+QEA25HJ/L/8Cuto
RrlePz93lZ6w4GnfGuavz+AQHTqy8gI=
=1jpr
-----END PGP SIGNATURE-----

AnteriorNode.js 26.13.1 (LTS)PróximoNode.js 22.23.5 (LTS)