This is the current version. · Released:
Installer files 22.23.4
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | MSI | All users | — | nodejs.org | VirusTotal |
| ARM64 | MSI | All users | — | nodejs.org | VirusTotal |
| 32-bit | MSI | All users | — | nodejs.org | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
This is a security release.
Notable Changes
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
- (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
- (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- deps: update timezone to 2026e (Node.js GitHub Bot)
- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
- deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
- deps: update undici to 6.29.1 (Node.js GitHub Bot)
Commits
- [68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
- [dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
- [a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
- [ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
- [a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
- [67d294739f] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
- [1ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
- [52b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
- [60f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
- [05470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
- [47333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
- [98258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
- [a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
- [e9e295bcc1] - deps: cherry-pick e807d4e379 from SQLite (Junsu Han) #63525
- [512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
- [e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
- [857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #66765
- [19c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
- [e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
- [50ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
- [a18ec92752] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
- [4342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
- [d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
- [beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
- [4b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
