Node.js 20 이전 버전 및 전체 버전

This is a security release.
Notable Changes
- (CVE-2026-21717) fix array index hash collision (Joyee Cheung) https://github.com/nodejs-private/node-private/pull/834
- (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) https://github.com/nodejs-private/node-private/pull/822
- (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) https://github.com/nodejs-private/node-private/pull/821
- (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) https://github.com/nodejs-private/node-private/pull/795
- (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) https://github.com/nodejs-private/node-private/pull/794
- (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) https://github.com/nodejs-private/node-private/pull/832
- (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) https://github.com/nodejs-private/node-private/pull/819
Commits
- [cfb51fa9ce] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#831
- [f333d0be5f] - deps: V8: override depot_tools version (Richard Lau) #62344
- [2acd5d1226] - deps: update undici to v6.24.1 (Matteo Collina) #62285
- [af5c144ebc] - (CVE-2026-21717) deps,build,test: fix array index hash collision (Joyee Cheung) nodejs-private/node-private#834
- [00ad47a28e] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821
- [0123309566] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#840
- [00830712bc] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#838
- [a0c73425da] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832
- [cc3f294507] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#839

Notable Changes
- [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983
- [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
- [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
Commits
- [6f580d5399] - assert: fix deepEqual always return true on URL (Xuguang Mei) #50853
- [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983
- [cc4f7af6f3] - build: skip sscache action on non-main branches (Joyee Cheung) #61790
- [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
- [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
- [fa88cc07e2] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #60662
- [88b2eec88a] - deps: update minimatch to 10.2.2 (Node.js GitHub Bot) #61830
- [5c053264f1] - deps: V8: backport 6a0a25abaed3 (Vivian Wang) #61687
- [4a398699d0] - deps: update googletest to 5a9c3f9e8d9b90bbbe8feb32902146cb8f7c1757 (Node.js GitHub Bot) #61731
- [4fa43adf15] - deps: update googletest to 56efe3983185e3f37e43415d1afa97e3860f187f (Node.js GitHub Bot) #61605
- [1a855d490c] - deps: update googletest to 85087857ad10bd407cd6ed2f52f7ea9752db621f (Node.js GitHub Bot) #61417
- [d8a9359826] - deps: update icu to 78.2 (Node.js GitHub Bot) #60523
- [e79cd3a0bb] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928
- [0707ade464] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925
- [dc5a3cddef] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827
- [46043b94c7] - deps: update zlib to 1.3.1-e00f703 (Node.js GitHub Bot) #61135
- [6be15a596e] - deps: update cjs-module-lexer to 2.2.0 (Node.js GitHub Bot) #61271
- [10881404cd] - deps: update timezone to 2025c (Node.js GitHub Bot) #61138
- [1594a78c85] - deps: update googletest to 065127f1e4b46c5f14fc73cf8d323c221f9dc68e (Node.js GitHub Bot) #61055
- [7fa2ee1933] - deps: update zlib to 1.3.1-63d7e16 (Node.js GitHub Bot) #60898
- [09259532ef] - deps: update googletest to 1b96fa13f549387b7549cc89e1a785cf143a1a50 (Node.js GitHub Bot) #60739
- [aa8bdb6886] - deps: update cjs-module-lexer to 2.1.1 (Node.js GitHub Bot) #60646
- [cc849fde27] - deps: update googletest to 279f847 (Node.js GitHub Bot) #60219
- [a99ba553a2] - deps: update googletest to 50b8600 (Node.js GitHub Bot) #59955
- [6349a79f5f] - deps: update googletest to 7e17b15 (Node.js GitHub Bot) #59131
- [8ba759f1a0] - deps: update googletest to 35b75a2 (Node.js GitHub Bot) #58710
- [927d906850] - deps: update googletest to e9092b1 (Node.js GitHub Bot) #58565
- [bf8919f5c2] - deps: update googletest to 0bdccf4 (Node.js GitHub Bot) #57380
- [ae6231dac0] - deps: update googletest to e235eb3 (Node.js GitHub Bot) #56873
- [0561c62e85] - deps: update minimatch to 10.1.2 (Node.js GitHub Bot) #61732
- [f0ef221b0d] - deps: update minimatch to 10.1.1 (Node.js GitHub Bot) #60543
- [15bd0da404] - deps: update archs files for openssl (Antoine du Hamel) #61912
- [04d439323f] - deps: upgrade openssl sources to openssl-3.0.19 (Antoine du Hamel) #61912
- [2ea16d3bd6] - deps: update corepack to 0.34.6 (Node.js GitHub Bot) #61510
- [622f973d1c] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #60842
- [2cd265d8b9] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #60643
- [65e839687b] - deps: update corepack to 0.34.2 (Node.js GitHub Bot) #60550
- [2dc99d2771] - dns: fix Windows SRV ECONNREFUSED by adjusting c-ares fallback detection (notvivek12) #61453
- [2c7b84b1d8] - doc: fix typo in http.md (Michael Solomon) #59354
- [a84b42667c] - doc: fix grammar in global dispatcher usage (Eng Zer Jun) #59344
- [ffd0ada45f] - doc: fix typo in test/common/README.md (Yoo) #59180
- [b4d9d006e7] - doc: fix broken sentence in URL.parse (Superchupu) #59164
- [45e9971d9c] - doc: fix typo in writing-test.md (SeokHun) #59123
- [e9fd10b5d6] - doc: fix fetch subsections in globals.md (Antoine du Hamel) #58933
- [3715dd1c2b] - doc: fix wrong RFC n

This is a security release.
Notable Changes
lib:
- (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/802
- (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797
lib,permission:
- (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
src:
- (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
src,lib:
- (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759
tls:
- (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796
Commits
- [8f9ba3f623] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
- [97fc9b0eb7] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#792
- [14fbbb510c] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#802
- [1febc48d5b] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
- [494f62dc23] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
- [d7a5c587c0] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
- [51f4de4b4a] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
- [85f73e7057] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

Notable Changes
- [6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
- [082e50d4a2] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
- [db68cec4cb] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #58313
Commits
- [0f644df42e] - build: fix 'implicit-function-declaration' on OpenHarmony platform (hqzing) #59547
- [fba0025b9c] - build: use windows-2025 runner (Michaël Zasso) #59673
- [3456ec946d] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #59956
- [6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
- [1788fb5f3d] - deps: update undici to 6.22.0 (Matteo Collina) #60112
- [5d61b55f24] - deps: update uvwasi to 0.0.23 (Node.js GitHub Bot) #59791
- [9f1e5e4637] - deps: update histogram to 0.11.9 (Node.js GitHub Bot) #59689
- [d0edb01d25] - deps: update googletest to eb2d85e (Node.js GitHub Bot) #59335
- [576242ff39] - deps: V8: cherry-pick a0d0d4fc4f19 (Ho Cheung) #60716
- [a07a277020] - deps: update corepack to 0.34.1 (Node.js GitHub Bot) #60314
- [fa5c5af8ce] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134
- [556113e2fc] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134
- [cd1536ca90] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133
- [acec79989e] - deps: V8: cherry-pick 6b1b9bca2a8 (zhoumingtao) #59283
- [e65b930aa7] - deps: V8: backport 2e4c5cf9b112 (Michaël Zasso) #60654
- [1b75a601f7] - doc: fix typo on child_process.md (Angelo Gazzola) #60114
- [a2bcb217c6] - doc: fix typo in section on microtask order (Tobias Nießen) #59932
- [2426d3f3ff] - doc: add security escalation policy (Ulises Gascón) #59806
- [e7f6f04758] - doc: add Miles Guicent as triager (Miles Guicent) #59562
- [e51ef3f48b] - doc: update install_tools.bat free disk space (Stefan Stojanovic) #59579
- [8a504d900a] - doc: fix missing link to the Error documentation in the http page (Alexander Makarenko) #59080
- [8c5c8aa71d] - doc: clarify experimental platform vulnerability policy (Matteo Collina) #59591
- [109c4bff77] - doc: add security incident reponse plan (Rafael Gonzaga) #59470
- [4f004efdf3] - doc: add RafaelGSS as performance strategic lead (Rafael Gonzaga) #59445
- [caa2db4bac] - doc: fix links in test.md (Vas Sudanagunta) #58876
- [082e50d4a2] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
- [19a66365d9] - doc: clarify DEP0194 scope (Antoine du Hamel) #58504
- [db68cec4cb] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #58313
- [3b2368774f] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #58291
- [960d05ad7d] - doc: add history entries to --input-type section (Antoine du Hamel) #58175
- [20616f1750] - http2: do not crash on mismatched ping buffer length (René) #60135
- [9eb94232c8] - lib: handle superscript variants on windows device (Rafael Gonzaga) #59261
- [dc58b4e35f] - meta: move Michael to emeritus (Michael Dawson) #60070
- [d943cfb260] - meta: bump actions/setup-node from 4.4.0 to 5.0.0 (dependabot[bot]) #60093
- [de9a3aaf0f] - meta: bump step-security/harden-runner from 2.12.2 to 2.13.1 (dependabot[bot]) #60094
- [b4b5d4a4d7] - meta: bump ossf/scorecard-action from 2.4.2 to 2.4.3 (dependabot[bot]) #60096
- [e5b4eee901] - meta: bump actions/setup-python from 5.6.0 to 6.0.0 (dependabot[bot]) #60090
- [7cb032c2c1] - meta: update devcontainer to the latest schema (Aviv Keller) #54347
- [bb108191aa] - meta: call create-release-post.yml post release (Aviv Keller) #60366
- [2a11d50526] - module: correctly detect top-level await in ambiguous contexts (Shima Ryuhei) #58646
- [144233b71a] - process: fix wrong asyncContext under unhandled-rejections=strict (Shima Ryuhei) #60103
- [409cb773a4] - repl: fix cpu overhead pasting big strings to the REPL (Ruben Bridgewater) #59857
- [d1c9d80cac] - repl: add isValidParentheses check before wrap input (Xuguang Mei) #59607
- [b8d145db2

Experimental Network Inspection Support in Node.js
This update introduces the initial support for network inspection in Node.js.
Currently, this is an experimental feature, so you need to enable it using the --experimental-network-inspection flag.
With this feature enabled, you can inspect network activities occurring within a JavaScript application.
To use network inspection, start your Node.js application with the following command:
$ node --inspect-wait --experimental-network-inspection index.js
Please note that the network inspection capabilities are in active development.
We are actively working on enhancing this feature and will continue to expand its functionality in future updates.
- Network inspection is limited to the http and https modules only.
- The Network tab in Chrome DevTools will not be available until the feature request on the Chrome DevTools side is addressed.
Contributed by Kohei Ueno in #53593 and #54246

Exposes X509_V_FLAG_PARTIAL_CHAIN to tls.createSecureContext
This releases introduces a new option to the API tls.createSecureContext. From now on, tls.createSecureContext({ allowPartialTrustChain: true }) can be used to treat intermediate (non-self-signed) certificates in the trust CA certificate list as trusted.
Contributed by Anna Henningsen in #54790

New option for vm.createContext() to create a context with a freezable globalThis
Node.js implements a flavor of vm.createContext() and friends that creates a context without contextifying its global object when vm.constants.DONT_CONTEXTIFY is used. This is suitable when users want to freeze the context (impossible when the global is contextified i.e. has interceptors installed) or speed up the global access if they don't need the interceptor behavior.
Contributed by Joyee Cheung in #54394

Deprecations
- [64aa31f6e5] - repl: doc-deprecate instantiating node:repl classes without new (Aviv Keller) #54842
- [4c52ee3d7f] - zlib: deprecate instantiating classes without new (Yagiz Nizipli) #54708

Other Notable Changes
- [b80da2f964] - buffer: optimize createFromString (Robert Nagy) #54324
- [02b36cbd2d] - (SEMVER-MINOR) lib: add EventSource Client (Aras Abbasi) #51575
- [879546a9bf] - (SEMVER-MINOR) src,lib: add performance.uvMetricsInfo (Rafael Gonzaga) #54413
- [f789f4c92d] - (SEMVER-MINOR) test_runner: support module mocking (Colin Ihrig) #52848
- [4eb0749b6c] - (SEMVER-MINOR) url: implement parse method for safer URL parsing (Ali Hassan) #52280

module: support require()ing synchronous ESM graphs
This release adds require() support for synchronous ESM graphs under the flag --experimental-require-module.
If --experimental-require-module is enabled, and the ECMAScript module being loaded by require() meets the following requirements:
- Explicitly marked as an ES module with a "type": "module" field in the closest package.json or a .mjs extension.
- Fully synchronous (contains no top-level await).
require() will load the requested module as an ES Module, and return the module name space object. In this case it is similar to dynamic import() but is run synchronously and returns the name space object directly.
Contributed by Joyee Cheung in #51977

path: add matchesGlob method
Glob patterns can now be tested against individual paths via the path.matchesGlob(path, pattern) method.
Contributed by Aviv Keller in #52881

stream: expose DuplexPair API
The function duplexPair returns an array with two items, each being a Duplex stream connected to the other side:
const [ sideA, sideB ] = duplexPair();
Whatever is written to one stream is made readable on the other. It provides behavior analogous to a network connection, where the data written by the client becomes readable by the server, and vice-versa.
Contributed by Austin Wright in #34111

Other Notable Changes
- [8e64c02b19] - (SEMVER-MINOR) http: add diagnostics channel http.client.request.error (Kohei Ueno) #54054
- [ae30674991] - meta: add jake to collaborators (jakecastelli) #54004
- [4a3ecbfc9b] - (SEMVER-MINOR) stream: implement min option for ReadableStreamBYOBReader.read (Mattias Buelens) #50888

process: add process.getBuiltinModule(id)
process.getBuiltinModule(id) provides a way to load built-in modules in a globally available function. ES Modules that need to support other environments can use it to conditionally load a Node.js built-in when it is run in Node.js, without having to deal with the resolution error that can be thrown by import in a non-Node.js environment or having to use dynamic import() which either turns the module into an asynchronous module, or turns a synchronous API into an asynchronous one.
If id specifies a built-in module available in the current Node.js process, process.getBuiltinModule(id) method returns the corresponding built-in module. If id does not correspond to any built-in module, undefined is returned.
process.getBuiltinModule(id) accepts built-in module IDs that are recognized by module.isBuiltin(id).
The references returned by process.getBuiltinModule(id) always point to the built-in module corresponding to id even if users modify require.cache so that require(id) returns something else.
Contributed by Joyee Cheung in #52762

doc: doc-only deprecate OpenSSL engine-based APIs
OpenSSL 3 deprecated support for custom engines with a recommendation to switch to its new provider model.
The clientCertEngine option for https.request(), tls.createSecureContext(), and tls.createServer(); the privateKeyEngine and privateKeyIdentifier for tls.createSecureContext(); and crypto.setEngine() all depend on this functionality from OpenSSL.
Contributed by Richard Lau in #53329

inspector: fix disable async hooks on Debugger.setAsyncCallStackDepth
Debugger.setAsyncCallStackDepth was previously calling the enable function by mistake. As a result, when profiling using Chrome DevTools, the async hooks won't be turned off properly after receiving Debugger.setAsyncCallStackDepth with depth 0.
Contributed by Joyee Cheung in #53473

Other Notable Changes
- [09e2191432] - (SEMVER-MINOR) buffer: add .bytes() method to Blob (Matthew Aitken) #53221
- [394e00f41c] - (SEMVER-MINOR) doc: add context.assert docs (Colin Ihrig) #53169
- [a8601efa5e] - (SEMVER-MINOR) doc: improve explanation about built-in modules (Joyee Cheung) #52762
- [5e76c258f7] - doc: add StefanStojanovic to collaborators (StefanStojanovic) #53118
- [5e694026f1] - doc: add Marco Ippolito to TSC (Rafael Gonzaga) #53008
- [f3ba1eb72f] - (SEMVER-MINOR) net: add new net.server.listen tracing channel (Paolo Insogna) #53136
- [2bcce3255b] - (SEMVER-MINOR) src,permission: --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
- [a03a4c7bdd] - (SEMVER-MINOR) test_runner: add context.fullName (Colin Ihrig) #53169
- [69b828f5a5] - (SEMVER-MINOR) util: support --no- for argument with boolean type for parseArgs (Zhenwei Jin) #53107

This is a security release.

Notable Changes
- CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
- CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
- CVE-2024-22018 - fs.lstat bypasses permission model (Low)
- CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
- CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

test_runner: support test plans
It is now possible to count the number of assertions and subtests that are expected to run within a test. If the number of assertions and subtests that run does not match the expected count, the test will fail.
Contributed by Colin Ihrig in #52860

inspector: introduce the --inspect-wait flag
This release introduces the --inspect-wait flag, which allows debugger to wait for attachement. This flag is useful when you want to debug the code from the beginning. Unlike --inspect-brk, which breaks on the first line, this flag waits for debugger to be connected and then runs the code as soon as a session is established.
Contributed by Kohei Ueno in #52734

zlib: expose zlib.crc32()
This release exposes the crc32() function from zlib to user-land.

It computes a 32-bit Cyclic Redundancy Check checksum of data. If value is specified, it is used as the starting value of the checksum, otherwise, 0 is used as the starting value.

The CRC algorithm is designed to compute checksums and to detect error in data transmission. It's not suitable for cryptographic authentication.
Contributed by Joyee Cheung in #52692

cli: allow running wasm in limited vmem with --disable-wasm-trap-handler
By default, Node.js enables trap-handler-based WebAssembly bound checks. As a result, V8 does not need to insert inline bound checks int the code compiled from WebAssembly which may speedup WebAssembly execution significantly, but this optimization requires allocating a big virtual memory cage (currently 10GB). If the Node.js process does not have access to a large enough virtual memory address space due to system configurations or hardware limitations, users won't be able to run any WebAssembly that involves allocation in this virtual memory cage and will see an out-of-memory error.

--disable-wasm-trap-handler disables this optimization so that users can at least run WebAssembly (with a less optimial performance when the virtual memory address space available to their Node.js process is lower than what the V8 WebAssembly memory cage needs.
Contributed by Joyee Cheung in #52766

Other Notable Changes
- [12512c3d0e] - doc: add pimterry to collaborators (Tim Perry) #52874
- [9d485b40bb] - (SEMVER-MINOR) tools: fix get_asan_state() in tools/test.py (Joyee Cheung) #52766
- [e98c305f52] - (SEMVER-MINOR) tools: support max_virtual_memory test configuration (Joyee Cheung) #52766
- [dce0300896] - (SEMVER-MINOR) tools: support != in test status files (Joyee Cheung) #52766

Notable Changes
- [28d2baa17c] - src,permission: throw async errors on async APIs (Rafael Gonzaga) #52730
- [77e2bf029a] - (SEMVER-MINOR) test_runner: support forced exit (Colin Ihrig) #52038

Commits
- [e3ad05d8b0] - deps: V8: cherry-pick 500de8bd371b (Richard Lau) #52676
- [053282e661] - deps: V8: backport c4be0a97f981 (Richard Lau) #52183
- [200dadb879] - deps: V8: cherry-pick f8d5e576b814 (Richard Lau) #52183
- [f5cd125e02] - deps: update googletest to fa6de7f (Node.js GitHub Bot) #52949
- [bbbfd7f4e1] - deps: update corepack to 0.28.1 (Node.js GitHub Bot) #52946
- [7ba30a57a6] - deps: update simdutf to 5.2.8 (Node.js GitHub Bot) #52727
- [b21a480a28] - deps: update simdutf to 5.2.6 (Node.js GitHub Bot) #52727
- [6cfad60d97] - deps: update googletest to 2d16ed0 (Node.js GitHub Bot) #51657
- [34708d1429] - deps: update googletest to d83fee1 (Node.js GitHub Bot) #51657
- [c1d3e558e8] - deps: update googletest to 5a37b51 (Node.js GitHub Bot) #51657
- [69959d0fca] - deps: update googletest to 5197b1a (Node.js GitHub Bot) #51657
- [c8305f6057] - deps: update googletest to eff443c (Node.js GitHub Bot) #51657
- [760b788704] - deps: update googletest to c231e6f (Node.js GitHub Bot) #51657
- [301541cc8f] - deps: update googletest to e4fdb87 (Node.js GitHub Bot) #51657
- [981d57e401] - deps: update googletest to 5df0241 (Node.js GitHub Bot) #51657
- [a1817f534d] - deps: update googletest to b75ecf1 (Node.js GitHub Bot) #51657
- [42070ca189] - deps: update googletest to 4565741 (Node.js GitHub Bot) #51657
- [edc3e5d056] - deps: update uvwasi to 0.0.21 (Node.js GitHub Bot) #52863
- [26b1231ffb] - deps: upgrade npm to 10.7.0 (npm team) #52767
- [e6d9fbece2] - doc: update process.versions properties (ishabi) #52736
- [8c1f837c0a] - doc: remove mold use on mac for speeding up build (Cong Zhang) #52252
- [d9c5114694] - doc: fix grammatical mistake (codershiba) #52808
- [b350f435b7] - meta: add mailmap entry for legendecas (Chengzhong Wu) #52795
- [61f9f12eff] - meta: bump actions/checkout from 4.1.1 to 4.1.4 (dependabot[bot]) #52787
- [ac563667d6] - meta: bump github/codeql-action from 3.24.9 to 3.25.3 (dependabot[bot]) #52786
- [70611d7924] - meta: bump actions/upload-artifact from 4.3.1 to 4.3.3 (dependabot[bot]) #52785
- [30482ea273] - meta: bump actions/download-artifact from 4.1.4 to 4.1.7 (dependabot[bot]) #52784
- [d1607cdebb] - meta: bump codecov/codecov-action from 4.1.1 to 4.3.1 (dependabot[bot]) #52783
- [21f1b6bfc3] - meta: bump step-security/harden-runner from 2.7.0 to 2.7.1 (dependabot[bot]) #52782
- [0c6019a222] - meta: standardize regex (Aviv Keller) #52693
- [28d2baa17c] - src,permission: throw async errors on async APIs (Rafael Gonzaga) #52730
- [cffd2cc0c9] - Revert "stream: revert fix cloned webstreams not being unref'd" (Marco Ippolito) #53144
- [3dd96f1fab] - stream: implement TransformStream cleanup using "transformer.cancel" (Debadree Chatterjee) #50126
- [8e7e778e01] - test: skip v8-updates/test-linux-perf (Michaël Zasso) #49639
- [f8e18869e9] - test: replace always-opt flag with alway-turbofan (Michaël Zasso) #50115
- [a501860d63] - test_runner: don't await the same promise for each test (Colin Ihrig) #52185
- [e2ae4367f4] - test_runner: run top level tests in a microtask (Colin Ihrig) #52092
- [77e2bf029a] - (SEMVER-MINOR) test_runner: support forced exit (Colin Ihrig) #52038
- [b7bc63565e] - test_runner: ignore todo flag when running suites (Colin Ihrig) #52117
- [be587e3ae3] - test_runner: use paths for test locations (Colin Ihrig) #52010
- [743281ab25] - test_runner: support source mapped test locations (Colin Ihrig) #52010
- [4051316d95] - tools: update lint-md-dependencies to rollup@4.17.0 (Node.js GitHub Bot) #52729

2024-05-09, Version 20.13.1 'Iron' (LTS), @marco-ippolito
Revert "tools: install npm PowerShell scripts on Windows"
Due to a regression in the npm installation on Windows, this commit reverts the change that installed npm PowerShell scripts on Windows.
Commits
- [b7d80802cc] - Revert "tools: install npm PowerShell scripts on Windows" (marco-ippolito) #52897

This is a security release.
Notable Changes
- CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
Commits
- [69ffc6d50d] - src: disallow direct .bat and .cmd file spawning (Ben Noordhuis) nodejs-private/node-private#563

This is a security release
Notable Changes
- CVE-2024-27983 - Assertion failed in nodehttp2Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
- CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
- llhttp version 9.2.1
- undici version 5.28.4
Commits
- [bd8f10a257] - deps: update undici to v5.28.4 (Matteo Collina) nodejs-private/node-private#576
- [5e34540a96] - http: do not allow OBS fold in headers by default (Paolo Insogna) nodejs-private/node-private#557
- [ba1ae6d188] - src: ensure to close stream when destroying session (Anna Henningsen) nodejs-private/node-private#561

Notable changes
This is a security release.
Notable changes
- CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
- CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
- CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
- CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
- CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
- undici version 5.28.3
- libuv version 1.48.0
- OpenSSL version 3.0.13+quic1
Commits
- [7079c062bb] - crypto: disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525
- [186a6e1ffb] - deps: fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) #51737
- [686da19abb] - deps: disable io_uring support in libuv by default (Tobias Nießen) nodejs-private/node-private#529
- [f7b44bfbce] - deps: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
- [7a30fecea2] - deps: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
- [480fc169a8] - fs: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) nodejs-private/node-private#497
- [77ac7c3153] - http: add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#519
- [ed7d149675] - lib: use cache fs internals against path traversal (RafaelGSS) nodejs-private/node-private#516
- [89bd5fc38f] - lib: update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#539
- [d01dd4291d] - permission: fix wildcard when children > 1 (Rafael Gonzaga) #51209
- [40ff37dfcc] - src: fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505
- [3f6addd590] - src,deps: disable setuid() etc if io_uring enabled (Tobias Nießen) nodejs-private/node-private#529
- [d6da413aa4] - test,doc: clarify wildcard usage (RafaelGSS) nodejs-private/node-private#517
- [c213910aea] - zlib: pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#541

Notable Changes
This release marks the transition of Node.js 20.x into Long Term Support (LTS) with the codename 'Iron'. The 20.x release line now moves into "Active LTS" and will remain so until October 2024. After that time, it will move into "Maintenance" until end of life in April 2026.
Known issue
Collecting code coverage via the NODE_V8_COVERAGE environment variable may lead to a hang. This is not thought to be a regression in Node.js 20 (some reports are on Node.js 18). For more information, including some potential workarounds, see issue #49344.

Commit
- [8acbe6d8e8] - esm: fix loading of CJS modules from ESM (Antoine du Hamel) #49500

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-32002: Policies can be bypassed via Module._load (High)
- CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High)
- CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High)
- CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
- CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
- CVE-2023-32005: fs.statfs can bypass the permission model (Low)
- CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low)
- OpenSSL Security Releases
- OpenSSL security advisory 14th July.
- OpenSSL security advisory 19th July.
- OpenSSL security advisory 31st July
More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.
Commits
- [92300b51b4] - deps: update archs files for openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
- [559698abf2] - deps: upgrade openssl sources to quictls/openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
- [1bf3429e8e] - lib,permission: restrict process.binding when pm is enabled (RafaelGSS) nodejs-private/node-private#438
- [98a83a67e6] - permission: ensure to resolve path when calling mkdtemp (RafaelGSS) nodejs-private/node-private#464
- [1f0cde466b] - permission: handle buffer path on fs calls (RafaelGSS) nodejs-private/node-private#439
- [bd094d60ea] - permission: handle fstatfs and add pm supported list (RafaelGSS) nodejs-private/node-private#441
- [7337d21484] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#417
- [cf348ec640] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#397

Notable Changes
- [45be29d89f] - doc: add atlowChemi to collaborators (atlowChemi) #48757
- [a316808136] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
- [986b46a567] - fs: add a fast-path for readFileSync utf-8 (Yagiz Nizipli) #48658
- [0ef73ff6f0] - (SEMVER-MINOR) test_runner: add shards support (Raz Luvaton) #48639
Commits
- [eb0aba59b8] - bootstrap: use correct descriptor for Symbol.{dispose,asyncDispose} (Jordan Harband) #48703
- [e2d0195dcf] - bootstrap: hide experimental web globals with flag kNoBrowserGlobals (Chengzhong Wu) #48545
- [67a1018389] - build: do not pass target toolchain flags to host toolchain (Ivan Trubach) #48597
- [7d843bb942] - child_process: use addAbortListener (atlowChemi) #48550
- [4e08160f8c] - child_process: support Symbol.dispose (Moshe Atlow) #48551
- [ef7728bf36] - deps: update nghttp2 to 1.55.1 (Node.js GitHub Bot) #48790
- [1454f02499] - deps: update nghttp2 to 1.55.0 (Node.js GitHub Bot) #48746
- [fa94debf46] - deps: update minimatch to 9.0.3 (Node.js GitHub Bot) #48704
- [c73cfcc144] - deps: update acorn to 8.10.0 (Node.js GitHub Bot) #48713
- [b7a076a052] - deps: V8: cherry-pick cb00db4dba6c (Keyhan Vakil) #48671
- [150e15536b] - deps: upgrade npm to 9.8.0 (npm team) #48665
- [c47b2cbd35] - dgram: socket add asyncDispose (atlowChemi) #48717
- [002ce31cca] - dgram: use addAbortListener (atlowChemi) #48550
- [45be29d89f] - doc: add atlowChemi to collaborators (atlowChemi) #48757
- [69b55d2261] - doc: fix ambiguity in http.md and https.md (an5er) #48692
- [caccb051c7] - doc: clarify transform._transform() callback argument logic (Rafael Sofi-zada) #48680
- [999ae0c8c3] - doc: fix copy node executable in Windows (Yoav Vainrich) #48624
- [7daefaeb44] - doc: drop <b> of v20 changelog (Rafael Gonzaga) #48649
- [dd7ea3e1df] - doc: mention git node release prepare (Rafael Gonzaga) #48644
- [cc7809df21] - esm: fix emit deprecation on legacy main resolve (Antoine du Hamel) #48664
- [67b13d1dba] - events: fix bug listenerCount don't compare wrapped listener (yuzheng14) #48592
- [a316808136] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
- [986b46a567] - fs: add a fast-path for readFileSync utf-8 (Yagiz Nizipli) #48658
- [e4333ac41f] - http2: use addAbortListener (atlowChemi) #48550
- [4a0b66e4f9] - http2: send RST code 8 on AbortController signal (Devraj Mehta) #48573
- [1295c76fce] - lib: use addAbortListener (atlowChemi) #48550
- [dff6c25a36] - meta: bump actions/checkout from 3.5.2 to 3.5.3 (dependabot[bot]) #48625
- [b5cb69ceaa] - meta: bump step-security/harden-runner from 2.4.0 to 2.4.1 (dependabot[bot]) #48626
- [332e480b46] - meta: bump ossf/scorecard-action from 2.1.3 to 2.2.0 (dependabot[bot]) #48628
- [25c5a0aaee] - meta: bump github/codeql-action from 2.3.6 to 2.20.1 (dependabot[bot]) #48627
- [6406f50ab1] - module: add SourceMap.lineLengths (Isaac Z. Schlueter) #48461
- [cfa69bd48c] - net: server add asyncDispose (atlowChemi) #48717
- [ac11264cc5] - net: use addAbortListener (atlowChemi) #48550
- [82d6b13bf6] - permission: add debug log when inserting fs nodes (Rafael Gonzaga) #48677
- [f4333b1cdd] - permission: v8.writeHeapSnapshot and process.report (Rafael Gonzaga) #48564
- [f691dca6c9] - readline: use addAbortListener (atlowChemi) #48550
- [227e6bd898] - src: pass syscall on fs.readFileSync fail operation (Yagiz Nizipli) #48815
- [a9a4b73653] - src: make BaseObject iteration order deterministic (Joyee Cheung) #48702
- [d99ea4845a] - src: remove kEagerCompile for CompileFunction (Keyhan Vakil) #48671
- [df363d0010] - src: deduplicate X509 getter implementations (Tobias Nießen) #48563
- [9cf2e1f55b] - src,lib: reducing C++ calls of esm legacy main resolve (Vinicius Lourenço) #48325
- [daeb21dde9] - stream: fix deadlock when pipeing to full sink (Robert Nagy) #48691
- [5a382d02d6] - stream: use addAbortListener (atlowChemi) #48550
- [6e82077dd4] - test: deflake test-net-throttle (Luigi Pinca) #48599
-