Node.js (LTS): all versions and old releases

This is a security release.
Notable Changes
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
- (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
- (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
- (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- deps: update timezone to 2026e (Node.js GitHub Bot)
- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
- deps: update undici to 7.30.1 (Node.js GitHub Bot)
Commits
- [2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
- [4d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
- [4b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007
- [9243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
- [1e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
- [49dff6f57a] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
- [fca511adc5] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008
- [18711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
- [fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
- [b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
- [ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
- [1d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #66764
- [843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
- [96c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
- [8dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
- [b5f41529df] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
- [01acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #66871
- [935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
- [de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
- [9dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

This is a security release.
Notable Changes
- (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
- deps: update llhttp to 9.4.3 (Paolo Insogna)
- deps: update undici to 7.29.0 (Node.js GitHub Bot)
Commits
- [6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
- [bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #64713
- [9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
- [8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
- [a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
- [34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
- [95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
- [fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
- [ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
- [9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
- [6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
- [af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
- [05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

This is a security release.
Notable Changes
- (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits
- [9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
- [cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
- [a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891
- [66e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891
- [dd627ced27] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820
- [684bae568f] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820
- [3a631e7f83] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656
- [cf44df3996] - deps: update undici to 7.28.0 (Node.js GitHub Bot) #63703
- [138c70294b] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
- [be7e719c3f] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
- [cc7c11b4d1] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
- [9224427b92] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
- [cf85d54839] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
- [a1bbc24f96] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
- [e3723ff2d6] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
- [a77af4867b] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
- [31beb4f707] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
- [8e75c73f91] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

This is a security release.
Notable Changes
- (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
- (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
- (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
- (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
- (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
- (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
- (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
- (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
Commits
- [6fae244080] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#828
- [cc0910c62e] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#822
- [80cb042cf3] - deps: update undici to 7.24.4 (Node.js GitHub Bot) #62271
- [f5b8667dc2] - deps: update undici to 7.24.3 (Node.js GitHub Bot) #62233
- [08852637d9] - deps: update undici to 7.22.0 (Node.js GitHub Bot) #62035
- [61097db9fb] - deps: upgrade npm to 11.11.0 (npm team) #61994
- [9ac0f9f81e] - deps: upgrade npm to 11.10.1 (npm team) #61892
- [3dab3c4698] - deps: V8: override depot_tools version (Richard Lau) #62344
- [87521e99d1] - deps: V8: backport 1361b2a49d02 (Joyee Cheung) nodejs-private/node-private#828
- [045013366f] - deps: V8: backport 185f0fe09b72 (Joyee Cheung) nodejs-private/node-private#828
- [af22629ea8] - deps: V8: backport 0a8b1cdcc8b2 (snek) nodejs-private/node-private#828
- [380ea72eef] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821
- [d6b6051e08] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#795
- [bfdecef9da] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#794
- [c015edf313] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832
- [cba66c48a5] - (CVE-2026-21712) src: handle url crash on different url formats (RafaelGSS) nodejs-private/node-private#816
- [df8fbfb93d] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#819

This is a security release.
Notable Changes
lib:
- (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797
- (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748
lib,permission:
- (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
src:
- (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
src,lib:
- (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759
tls:
- (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796
Commits
- [2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
- [3e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283
- [4ba536a5a6] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
- [89adaa21fd] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
- [7302b4dae1] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
- [ac030753c4] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
- [20075692fe] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
- [20591b0618] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

Notable Changes
The known issue relating to Buffer.allocUnsafe incorrectly zero-filling buffers
has now been addressed and now returns uninitialized memory as documented in the
Buffer.allocUnsafe
documentation.
Commits
- [0a15ccf3f4] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162
- [a1c7d1dac9] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #60205
- [99e2acf46b] - benchmark: add vm.SourceTextModule benchmark (Joyee Cheung) #59396
- [c01c72b407] - benchmark: use non-deprecated WriteUtf8V2 method (Michaël Zasso) #60173
- [a42dbd138e] - build: ibmi follow aix visibility (SRAVANI GUNDEPALLI) #60360
- [5673a54a5d] - build: use call command when calling python configure (Jacob Nichols) #60098
- [c67cb727cb] - build: build v8 with -fvisibility=hidden -fvisibility-inlines-hidden (Joyee Cheung) #56290
- [b03f7b93b1] - build: remove V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE defs (Joyee Cheung) #60296
- [2505568531] - build, src: fix include paths for vtune files (Rahul) #59999
- [95330b036f] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #59956
- [c221d892ef] - deps: update corepack to 0.34.2 (Node.js GitHub Bot) #60550
- [bc00aa4c77] - deps: update simdjson to 4.0.7 (Node.js GitHub Bot) #59883
- [d03b89ec53] - deps: update corepack to 0.34.1 (Node.js GitHub Bot) #60314
- [b7882090de] - deps: update inspector_protocol to af7f5a8173fdbc29f0835ec94395932e328b (Node.js GitHub Bot) #60312
- [7007f9dd65] - deps: update googletest to 279f847 (Node.js GitHub Bot) #60219
- [a56aa9ffa8] - deps: upgrade npm to 11.6.2 (npm team) #60168
- [0bf8952721] - doc: mention more codemods in deprecations.md (Augustin Mauroy) #60243
- [2473ca77f6] - doc: add missing CAA type to dns.resolveAny() & dnsPromises.resolveAny() (Jimmy Leung) #58899
- [39ddd8522e] - doc: use any for worker_threads.Worker 'error' event argument err (Jonas Geiler) #60300
- [eaa825fd97] - doc: update decorator documentation to reflect actual policy (Muhammad Salman Aziz) #60288
- [a744e42282] - doc: document wildcard supported by tools/test.py (Joyee Cheung) #60265
- [ec0d5beb09] - doc: add --heap-snapshot-on-oom to useful v8 flag (jakecastelli) #60260
- [13da0df12a] - doc: fix blob.bytes() heading level (XTY) #60252
- [8e771632b7] - doc: fix not working code example in vm docs (Artur Gawlik) #60224
- [70c2080bff] - doc: improve code snippet alternative of url.parse() using WHATWG URL (Steven) #60209
- [beadcf176e] - doc: createSQLTagStore → createTagStore (Aviv Keller) #60182
- [b0da3b9c6a] - doc: use markdown when branch-diff major release (Rafael Gonzaga) #60179
- [688115aa6b] - doc: update teams in collaborator-guide.md and add links (Bart Louwers) #60065
- [923082a064] - doc: disambiguate top-level worker_threads module exports (René) #59890
- [7be4330870] - doc: add known issue to v24.11.0 release notes (Richard Lau) #60467
- [4d8f62aeaf] - doc, module: change async customization hooks to experimental (Gerhard Stöbich) #60302
- [d86a118bbd] - http: lazy allocate cookies array (Robert Nagy) #59734
- [8c256d4139] - http: fix http client leaky with double response (theanarkh) #60062
- [265e9d59fa] - http2: rename variable to additionalPseudoHeaders (Tobias Nießen) #60208
- [65bec037e2] - http2: do not crash on mismatched ping buffer length (René) #60135
- [9b83ef53b7] - inspector: add network payload buffer size limits (Chengzhong Wu) #60236
- [03ac05c458] - inspector: support handshake response for websocket inspection (Shima Ryuhei) #60225
- [aa04f06190] - lib: fix typo in createBlobReaderStream (SeokHun) #60132
- [5aea1a429e] - lib: fix constructor in _errnoException stack tree (SeokHun) #60156
- [4f7745acc7] - lib: fix typo in QuicSessionStats (SeokHun) #60155
- [f8725861ea] - lib: remove redundant destroyHook checks (Gürgün Dayıoğlu) #60120
- [696c20bf3f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #60325
- [90434ff99a] - meta: loop userland-migrations in deprecations (Chengzhong Wu

Notable Changes
This release marks the transition of Node.js 24.x into Long Term Support (LTS)
with the codename 'Krypton'. It will continue to receive updates through to
the end of April 2028.
Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 24.10.0 are included.