Node.js 25.3.0 (Current)

Rafael Gonzaga

2026-01-13, Version 25.3.0 (Current), @RafaelGSS

This is a security release.

Notable Changes

(CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750
(CVE-2026-21636) add network check on pipe_wrap connect (RafaelGSS) https://github.com/nodejs-private/node-private/pull/784
(CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
(CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748
(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759
(CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/790

Commits

[a6a74b89a7] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
[5100614e26] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283
[f0a8916887] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#750
[b4b887c5f7] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
[26be208039] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
[bdf5873d44] - (CVE-2026-21636) permission: add network check on pipe_wrap connect (RafaelGSS) nodejs-private/node-private#784
[0578e3e921] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
[4d6b55a6d1] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
[c357a39e14] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#790

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

2b281c24a295d517fec0e31f0508810b229e2377cefdf97798c74fa8c7de8163  node-v25.3.0-aix-ppc64.tar.gz
6f6d3bbc3edf9f52e168fcacb065bdb6ab8a496b9a6e75ee11637fc3a79cb873  node-v25.3.0-arm64.msi
d80f384c182971724a7aa819173084e1d8244338fa8e9271a1961d38274d7209  node-v25.3.0-darwin-arm64.tar.gz
2a59bb95e3025f2928f7c6383c98f5c000845ff9f2b847063fa1dc72ecf3b9b2  node-v25.3.0-darwin-arm64.tar.xz
d6d494e5deca973556e146555cdd29b927b0adb3cae2f234b8e1a92310657c39  node-v25.3.0-darwin-x64.tar.gz
979d124e178a24c56eebe9786f359ea9ad533aab8ef39c4941fa0c72f1c37f77  node-v25.3.0-darwin-x64.tar.xz
aff7dc51eca4c08e025785674047e4e0b8cf3cf0481e8bcc5870b7b56ecea39d  node-v25.3.0-headers.tar.gz
8ba495ef14af626b44b4cfc463e3cbd7c976d130c79f465d32bda33e0efe9c2c  node-v25.3.0-headers.tar.xz
8098e098dc91ec3bf98035eeebff8d9b3e46fb9e14c1e8c377986f76e0b8368f  node-v25.3.0-linux-arm64.tar.gz
7d216a3fd253221da593d06d53fb201da01bd89ac6b3618c91740f379706d71a  node-v25.3.0-linux-arm64.tar.xz
7564e1fea56baca6fb701dc625ddff239371b7ca63be5691dad6f6911dae85eb  node-v25.3.0-linux-ppc64le.tar.gz
552f7176bc10997e8a3c0c13a2b94638d5a11f39200e115d5978dc1d2305a823  node-v25.3.0-linux-ppc64le.tar.xz
53798fa258a37a353395e97d6ffb25d1a8e42258ebc933041b20b55bab1104c4  node-v25.3.0-linux-s390x.tar.gz
aa8ed1656774ab90ae26266f72f6ce78f4ba3feb0d52dca880f29d662888a923  node-v25.3.0-linux-s390x.tar.xz
cc91362eb9a009efa26117c39c7bd55fe130123f01cf60d300b8b57e9501c27c  node-v25.3.0-linux-x64.tar.gz
31d124b6b56a83173a7b3bb9ab2c0ec58a0bfcb4e00864707807318ba3ddfa6d  node-v25.3.0-linux-x64.tar.xz
088391dd77fbd92a2dd495615cdea92fdf11ec5dc70f3e724b8b7f2f0965bf6e  node-v25.3.0-win-arm64.7z
ef217b4313cc6e9bd34a599e4d90f2e40a7ca5c30ae5a3098b32054b1c0d1727  node-v25.3.0-win-arm64.zip
61eac0c670c86a34c3764a0e9c301aa2f7260ccb80adc13c3e53280fdff2f04f  node-v25.3.0-win-x64.7z
3c138ba2cd835b1af70ae2813422f544b2e786bdff8c0885ffb89fb7d407148e  node-v25.3.0-win-x64.zip
3f8c82f6d7edc2b00a1c9852e3bdd16feb6dbf8990279da9650a2fca9ebfdd65  node-v25.3.0-x64.msi
09bd3f5619aed0dc5f3aaf9de50cea52ffbabc79b5bda36e8e88dbed26405710  node-v25.3.0.pkg
36cf586c51f20832ad27790f278f89f98a8dd957c4d6593d4f34e492249b3352  node-v25.3.0.tar.gz
97939099edd035a0c1a2d1fc849cac018ec2a38c0c28dd8e8246fd883cdb9e9e  node-v25.3.0.tar.xz
ec945fb2f2ee283225de505b58518d40e31dfa20fdedbb5b35e44ab173dca456  win-arm64/node.exe
8505f43c0673d071ace6d57c0008eae3b7eca1b7cd6d334c7a632eff056a090e  win-arm64/node.lib
6a3d1f7b9bc4c2953fd0ea3991ab4b6b1f03174d0691013a129f5ec5414ce058  win-arm64/node_pdb.7z
4c1aa600d3eff04cd43677539271ef2fd3400ceb1101b9af1257470dfd79dae5  win-arm64/node_pdb.zip
660281da866a222495759906d4ad90f84549f9cca8aa7fff3559df087140bd28  win-x64/node.exe
d5fa10f3ab2f43420a7f2253a14508802e42541b14cd805e5f04d51cc0caa21f  win-x64/node.lib
424950cb1c34dad3216753308922f7ecb5a0d1773900c5f2b1bf95ed22b29cf1  win-x64/node_pdb.7z
349af8b9a1a4ceea98ab2a814c32dc6ac3e8724334fa1ca35439602a6b696476  win-x64/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmlmTWMACgkQi+q0389V
XvSCcgv+JHQgZ1ZTToSsl6QgpghY0GdIk1gsycd4qVBrdRRevRv1j7JjyhFegdCf
zr1DLU+Ze0h2VdetrGoPUHD/xpJ4ZjnK2dATQcx6kDNuXoTIJhuFXRBiWuWH8D+Y
bBhAQJaRYs3tbsE2w+0DbbGG3mqqHalu7Ft+v4OYAVXOYoGf/c7bKWykax0/0tv/
sxugysrx/QdMRTfq91kDXQ9cvAZENHPc2SCD+dV+6pCTIJEEecsZ0gS/1z9FROZc
qUudaN8/cqeh6qGLixIMmBEkH7zwDBAKXCT2ZLtivsw7eh2UtafoZzEGOUVAUh+a
BHCWzFQYO3JEOtwrx0O3kKI9nPpshiTjqpZfbiPsd6/hOZ+1eqqVcYTTmCQBaq/x
bsYOfd5Ccow9ARuqYQh6/8gfgFYV8dzLWY7OlXjuOLCXSVY6/ppjuFg7cq+69eKC
RaKrNU9NAx+uWYos8ky6wpblieILwBh37TlAB7FUODwEqOXDYhUezxtQMJsoH2N3
6WYmaOmU
=ftL2
-----END PGP SIGNATURE-----

Node.js 22.22.0 (LTS)Node.js 24.13.0 (LTS)