Node.js 24.22.1 (LTS)

Antoine du Hamel

2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95

This is a security release.

Notable Changes

(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
(CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
deps: update timezone to 2026e (Node.js GitHub Bot)
deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
deps: update undici to 7.30.1 (Node.js GitHub Bot)

Commits

[2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
[4d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
[4b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007
[9243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
[1e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
[49dff6f57a] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
[fca511adc5] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008
[18711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
[fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
[b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
[ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
[1d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #66764
[843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
[96c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
[8dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
[b5f41529df] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
[01acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #66871
[935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
[de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
[9dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

f627b6d079829e648a4b800ffa889d37dbe23913507030030db85aa861591a26  node-v24.22.1-aix-ppc64.tar.gz
5faf40b7cba01eba47dfff7b5322979f27d0e8f042bab96cc567a3df01ec9796  node-v24.22.1-arm64.msi
89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7  node-v24.22.1-darwin-arm64.tar.gz
654ba79de6155647e22321932b45f2a1ccb705976cc337c9b8e278beb085a628  node-v24.22.1-darwin-arm64.tar.xz
d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035  node-v24.22.1-darwin-x64.tar.gz
65e450f90a6eaacd5000f611861c4ce65fadc87f813795dc4ed0c0e5f2fca2d4  node-v24.22.1-darwin-x64.tar.xz
322e0a27db9088093ab8347bdc8c7e0aaa21dc9ed548390bf06b394494c09267  node-v24.22.1-headers.tar.gz
33bf331af1c9812d25f82efb53de793b36b54c23b8ad49652c4325bbe7f98216  node-v24.22.1-headers.tar.xz
33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3  node-v24.22.1-linux-arm64.tar.gz
dbabf7a1cbf947e6059ffad2c27b80041db97dea1e553b62afdee7f13fca336e  node-v24.22.1-linux-arm64.tar.xz
9ce5728445016b29e49ad098f7a336061aa5f770d177d927278bc26fd626e643  node-v24.22.1-linux-ppc64le.tar.gz
5939d9e66b5a7e58c97f2a287787c5151147f33d43c41ad3261254b148374fdf  node-v24.22.1-linux-ppc64le.tar.xz
71979aeb1c385bc8ee83100d383a3b1ec0a5202e03df9f996a70403309caffb5  node-v24.22.1-linux-s390x.tar.gz
339aa21a40c321a2af55b7f7547117250b3d6f8149568bca59b5e17c2931ac22  node-v24.22.1-linux-s390x.tar.xz
9b250d29d6ab8ae38dd23019e2c04a6d6b2916ab1dad721c5f6e1da2b2901c6a  node-v24.22.1-linux-x64-musl.tar.gz
b83b6d679e4bf1128c8e9e982f3e64cd8badaddf1e38613aa36f93186395f9fa  node-v24.22.1-linux-x64-musl.tar.xz
eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c  node-v24.22.1-linux-x64.tar.gz
6c172a9ab6718f7b801fb5a7bd486af2ee5e32758086a04b84fcce2aa77095e6  node-v24.22.1-linux-x64.tar.xz
ca7618402754944626787fca386c406a041541f097da172e92348d8b1e44e48b  node-v24.22.1.pkg
001773d9bd53fbd27a25efd42aa6a9693ebfe500998ca9bec635e9b6ee79bc91  node-v24.22.1.tar.gz
4f5379796280cdaeb0c2f358fd04b6a16cc4fb7dfa83b5a8c91a9d963b435231  node-v24.22.1.tar.xz
aa26929d4ca7754aac3bd7fd018eb5c1c7961d00adf8aebf35c435d66edef62e  node-v24.22.1-win-arm64.7z
a0c807319fede24c4a0d8f84564c82a619bd313b16b10c007c383c2609e99171  node-v24.22.1-win-arm64.zip
bf9245db3a3bb281da45fee3974a74403687ea6030587bee4fd992efc822c35c  node-v24.22.1-win-x64.7z
d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5  node-v24.22.1-win-x64.zip
3bda4baf1ee709b33cf920dd633106ddb23951e322bff9c03ec9f64ab8981b01  node-v24.22.1-x64.msi
8bea91dc437fe01e7d92ef0efc6c9eaf654369aaba9b2d3e9841552ea7b95a00  win-arm64/node.exe
2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d  win-arm64/node.lib
ba8f5888df95f14c9de399863d2f8be82f05b4ad40d6ac390c00c8027c755486  win-arm64/node_pdb.7z
60f345bf8f9cbbfce57a97ebccd11433356bbb6f39ecbd23ca2eb51c6303a180  win-arm64/node_pdb.zip
d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5  win-x64/node.exe
a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7  win-x64/node.lib
75653d93bc58a9ae2d6bd419130126d881e27f804fd9e2cd0356696fe1f1a328  win-x64/node_pdb.7z
d61a585824e5504e1dfa0ceb7ad6981176f59531500303a97b790ccfe248a2c1  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCatiVbQAKCRAgsaOQsWjT
VsbAAQD1dxxGKpYhXszjCyau6srZaTCrvidfCFMXEG2uDG+9gAEA1x/U+J1rUUVw
wRP69XQlBX/P1htt1WNCKiGnPxSZBQ8=
=yktz
-----END PGP SIGNATURE-----

Node.js 26.12.1 (Current)Node.js 22.23.4 (LTS)