Node.js 26.13.1 (LTS)

Antoine du Hamel

2026-11-11, Version 26.13.1 'Lithium' (LTS), @aduh95

This is a security release.

Notable Changes

(CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
(CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
(CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
(CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
(CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
(CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
(CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
(CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
(CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
(CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
(CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
(CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
(CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
(CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
(CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
(CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
(CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
(CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
deps: update brotli to 1.2.1 (Node.js GitHub Bot)
deps: update llhttp to 9.4.4 (Antoine du Hamel)
deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
deps: update undici to 8.12.4 (Node.js GitHub Bot)

Commits

[7b777661f5] - build: respect OpenSSL's configured API level (Filip Skokan) #66953
[4518c7501f] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
[94b73673b8] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
[e315236158] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
[8e714f7daa] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272
[af48b1a4d5] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990
[60316405bb] - deps: update undici to 8.12.3 (Node.js GitHub Bot) #66993
[89b17baef4] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
[d14db811c7] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
[9183db64fe] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
[62ae278a23] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
[7df134e2ce] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
[0ff0cf6749] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
[a84a01ddb8] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
[3fc67dc056] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
[df4011dafe] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
[fa61009dc1] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
[40d3d8ddca] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
[6c85b8e371] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
[a8d6286949] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
[e750e1fa02] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
[97b1357f08] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
[66e72ec604] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
[940cae5c33] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
[8232390dd8] - tools: use vendored trust store in shell.nix (Antoine du Hamel) #67318
[6c223db6e2] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

65e55fb13dd6d9d43e2613526e72acb1bffcb2f3f185598d7b76e78ec237ad03  node-v26.13.1-aix-ppc64.tar.gz
7ec0190f09d3293afee0a5a5beea82638afb3c6fa41b7af14fdfe7524a865f0f  node-v26.13.1-arm64.msi
aec2514ea1ceb2ba52455e9ec65986f6749a06dd759e5db2a72e6889668c9735  node-v26.13.1-darwin-arm64.tar.gz
af6202f5370a3a5209e85dc543758dfd9f44c8726626a236730cd603a67a8559  node-v26.13.1-darwin-arm64.tar.xz
82bb96078a24ca50b9c9a38f2379e6be6d87171fcd400fc14c8934b3bce96e2f  node-v26.13.1-darwin-x64.tar.gz
2693310b2820f9350d29524f21344e1c623875bab773457d55b2aceb9670716f  node-v26.13.1-darwin-x64.tar.xz
f4466bc8df8b13aff09762f70631f415e790d8b021eadc6e54affa20bc52d547  node-v26.13.1-headers.tar.gz
02c39fd1ae84fdb2c5114ffff7cb3abefdf422c23546604882892ebf975818fc  node-v26.13.1-headers.tar.xz
80a330b35415382878df18d41afbd106ea89bfb3be0087d6608e289a14c5cc7d  node-v26.13.1-linux-arm64.tar.gz
89e1853138db51e8b82d3e98ba9c0d3f2956a28e5e55ea1b7e12d25aae92d5dd  node-v26.13.1-linux-arm64.tar.xz
f958bba5e944344d4dd87305ebbaba55cdb5be58211a24f4f6a12a6ae6bd16ee  node-v26.13.1-linux-ppc64le.tar.gz
06d5638602a919cb9a559eb92520862a387b4a0b170fed8883930b1eb392ec73  node-v26.13.1-linux-ppc64le.tar.xz
f2baeb7be8821697e7038446bd8d06af164c0e8dcbc40439afe841dc68e6d8de  node-v26.13.1-linux-s390x.tar.gz
2d65ece78005320dd13cccf15eeb30636a7352c18b92727f4b7c079de7d6969f  node-v26.13.1-linux-s390x.tar.xz
baa23b6ecd8555804bf7a4e8702f1637203916a10d286d3ee16fce8bf5637b83  node-v26.13.1-linux-x64-musl.tar.gz
c2ade3fc8a670f0b110eb68c020026daf1ac57b4fceed1ca471106fc144d8720  node-v26.13.1-linux-x64-musl.tar.xz
518674de2b621728a5e4486f5fb3b7d2900bb3cc4aa97969edaa463db99f9778  node-v26.13.1-linux-x64.tar.gz
5c063e46bab0fbc1c17cc445d7ff129cbdcd0471be6ed83b6ab864f8143bc864  node-v26.13.1-linux-x64.tar.xz
39a029bc6548532c96eb7af1e2904d73d7fc368f699f3339a4c403546317af4e  node-v26.13.1.pkg
60c6cdf11c3e9d5932fccd0eafae77f1152661584e129047684cb8646f228d3e  node-v26.13.1.tar.gz
a7f6204ff63b6a2cd274d48903285abb86ed53a99070e532d4c2fd787457d9e6  node-v26.13.1.tar.xz
db5ee0348e945b2e6d7721bcc5f3c1138eb15e5f484d74a8f4b3d37f7506b00a  node-v26.13.1-win-arm64.7z
181ebe431b90787113a9e4fc80d38ce86d37888a353a0386de44d2872e48cb97  node-v26.13.1-win-arm64.zip
472fddfebb740170c2ae7cd4faed5ee86c543c3a70ad2ebf8a9f01399d208472  node-v26.13.1-win-x64.7z
e2edda75bfb089654705cf65a13b58933bfd5f57148e8ebda916f58a2474f1f7  node-v26.13.1-win-x64.zip
0398ced8446e119478c724d1aa37c5afd6aa1a76fceab12787eb9714c5ed8b45  node-v26.13.1-x64.msi
00edc356a01d7fe586beebe7519bb1acdff9dd62064ce4cf12ff1ed4a8d1810e  win-arm64/node.exe
45084cbfc0170d7a30b29ab1eeeb2b0d770995ade0a13a4cc82cf31189f95c9f  win-arm64/node.lib
c2a9dc12e52e46ab5030c0e9077fde45a9ec74d1dd0d3271edc8b2cd9d95671d  win-arm64/node_pdb.7z
06094ea96323a63b4c5e52353e949dd051e760e6e615a802ba6a8ed068e3a739  win-arm64/node_pdb.zip
f5109dc868ec38703ad8f305e0aceece717cb60d4889873f434017af4e96cccb  win-x64/node.exe
caad0090dc3add94c06abd01e395e8ec0f1586c10071bda1f99480445d695f6f  win-x64/node.lib
990a9af78a41f8e814cf4a1f270aaa1b2735761dcaf3f057e9efc1bf4a8e6a7d  win-x64/node_pdb.7z
fe0338d99b79528991c3788ee0d0e3104d639775e31a6c39406d5ca67a0b09ab  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSa9AAKCRAgsaOQsWjT
Vh5oAP9u8Y21ggVtmKvswMRYIGosKkWTpwst08uzWLcpXZgbygEAx64vu2qYylXB
rsE4UKrUL4LQWBASR0npRxfkhSHHtQs=
=j8a2
-----END PGP SIGNATURE-----

ÎnainteNode.js 24.22.3 (LTS)