feat(blog): create post for v26.13.1

Author: create-or-update-pull-request

apps/site/pages/en/blog/release/v26.13.1.md

@@ -0,0 +1,131 @@
+---
+date: '2026-11-11T16:45:20.703Z'
+category: release
+title: Node.js 26.13.1 (LTS)
+layout: blog-post
+author: Antoine du Hamel
+---
+
+## 2026-11-11, Version 26.13.1 'Lithium' (LTS), @aduh95
+
+This is a security release.
+
+### Notable Changes
+
+- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
+- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
+- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
+- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
+- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
+- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
+- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
+- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
+- (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
+- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
+- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
+- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
+- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
+- (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
+- (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
+- (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
+- (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
+- (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
+- deps: update brotli to 1.2.1 (Node.js GitHub Bot)
+- deps: update llhttp to 9.4.4 (Antoine du Hamel)
+- deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
+- deps: update undici to 8.12.4 (Node.js GitHub Bot)
+
+### Commits
+
+- \[[`7b777661f5`](https://github.com/nodejs/node/commit/7b777661f5)] - **build**: respect OpenSSL's configured API level (Filip Skokan) [#66953](https://github.com/nodejs/node/pull/66953)
+- \[[`4518c7501f`](https://github.com/nodejs/node/commit/4518c7501f)] - **crypto**: fix builds with older OpenSSL 3.0 (Filip Skokan) [#66931](https://github.com/nodejs/node/pull/66931)
+- \[[`94b73673b8`](https://github.com/nodejs/node/commit/94b73673b8)] - **deps**: brotli: cherry-pick e230f474b87 (liujiahui) [#61003](https://github.com/nodejs/node/pull/61003)
+- \[[`e315236158`](https://github.com/nodejs/node/commit/e315236158)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038)
+- \[[`8e714f7daa`](https://github.com/nodejs/node/commit/8e714f7daa)] - **deps**: update undici to 8.12.4 (Node.js GitHub Bot) [#67272](https://github.com/nodejs/node/pull/67272)
+- \[[`af48b1a4d5`](https://github.com/nodejs/node/commit/af48b1a4d5)] - **deps**: update brotli to 1.2.1 (Node.js GitHub Bot) [#66990](https://github.com/nodejs/node/pull/66990)
+- \[[`60316405bb`](https://github.com/nodejs/node/commit/60316405bb)] - **deps**: update undici to 8.12.3 (Node.js GitHub Bot) [#66993](https://github.com/nodejs/node/pull/66993)
+- \[[`89b17baef4`](https://github.com/nodejs/node/commit/89b17baef4)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#66816](https://github.com/nodejs/node/pull/66816)
+- \[[`d14db811c7`](https://github.com/nodejs/node/commit/d14db811c7)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001)
+- \[[`9183db64fe`](https://github.com/nodejs/node/commit/9183db64fe)] - **http2**: retain streams during pending writes (Matteo Collina) [nodejs-private/node-private#1040](https://github.com/nodejs-private/node-private/pull/1040)
+- \[[`62ae278a23`](https://github.com/nodejs/node/commit/62ae278a23)] - **http2**: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) [nodejs-private/node-private#1000](https://github.com/nodejs-private/node-private/pull/1000)
+- \[[`7df134e2ce`](https://github.com/nodejs/node/commit/7df134e2ce)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017)
+- \[[`0ff0cf6749`](https://github.com/nodejs/node/commit/0ff0cf6749)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026)
+- \[[`a84a01ddb8`](https://github.com/nodejs/node/commit/a84a01ddb8)] - **http2**: avoid overflowing ALTSVC buffers (Matteo Collina) [nodejs-private/node-private#1035](https://github.com/nodejs-private/node-private/pull/1035)
+- \[[`3fc67dc056`](https://github.com/nodejs/node/commit/3fc67dc056)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#66641](https://github.com/nodejs/node/pull/66641)
+- \[[`df4011dafe`](https://github.com/nodejs/node/commit/df4011dafe)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#67252](https://github.com/nodejs/node/pull/67252)
+- \[[`fa61009dc1`](https://github.com/nodejs/node/commit/fa61009dc1)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036)
+- \[[`40d3d8ddca`](https://github.com/nodejs/node/commit/40d3d8ddca)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967)
+- \[[`6c85b8e371`](https://github.com/nodejs/node/commit/6c85b8e371)] - **tls**: fix remotely reachable TLS server crash (Tim Perry) [nodejs-private/node-private#1018](https://github.com/nodejs-private/node-private/pull/1018)
+- \[[`a8d6286949`](https://github.com/nodejs/node/commit/a8d6286949)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
+- \[[`e750e1fa02`](https://github.com/nodejs/node/commit/e750e1fa02)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
+- \[[`97b1357f08`](https://github.com/nodejs/node/commit/97b1357f08)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
+- \[[`66e72ec604`](https://github.com/nodejs/node/commit/66e72ec604)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020)
+- \[[`940cae5c33`](https://github.com/nodejs/node/commit/940cae5c33)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021)
+- \[[`8232390dd8`](https://github.com/nodejs/node/commit/8232390dd8)] - **tools**: use vendored trust store in `shell.nix` (Antoine du Hamel) [#67318](https://github.com/nodejs/node/pull/67318)
+- \[[`6c223db6e2`](https://github.com/nodejs/node/commit/6c223db6e2)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037)
+
+Windows 64-bit Installer: https://nodejs.org/dist/v26.13.1/node-v26.13.1-x64.msi \
+Windows ARM 64-bit Installer: https://nodejs.org/dist/v26.13.1/node-v26.13.1-arm64.msi \
+Windows 64-bit Binary: https://nodejs.org/dist/v26.13.1/win-x64/node.exe \
+Windows ARM 64-bit Binary: https://nodejs.org/dist/v26.13.1/win-arm64/node.exe \
+macOS 64-bit Installer: https://nodejs.org/dist/v26.13.1/node-v26.13.1.pkg \
+macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-darwin-arm64.tar.gz \
+macOS Intel 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-darwin-x64.tar.gz \
+Linux 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-linux-x64.tar.xz \
+Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-linux-ppc64le.tar.xz \
+Linux s390x 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-linux-s390x.tar.xz \
+AIX 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-aix-ppc64.tar.gz \
+ARMv8 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-linux-arm64.tar.xz \
+Source Code: https://nodejs.org/dist/v26.13.1/node-v26.13.1.tar.gz \
+Other release files: https://nodejs.org/dist/v26.13.1/ \
+Documentation: https://nodejs.org/docs/v26.13.1/api/
+
+### SHASUMS
+
+```
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+65e55fb13dd6d9d43e2613526e72acb1bffcb2f3f185598d7b76e78ec237ad03  node-v26.13.1-aix-ppc64.tar.gz
+7ec0190f09d3293afee0a5a5beea82638afb3c6fa41b7af14fdfe7524a865f0f  node-v26.13.1-arm64.msi
+aec2514ea1ceb2ba52455e9ec65986f6749a06dd759e5db2a72e6889668c9735  node-v26.13.1-darwin-arm64.tar.gz
+af6202f5370a3a5209e85dc543758dfd9f44c8726626a236730cd603a67a8559  node-v26.13.1-darwin-arm64.tar.xz
+82bb96078a24ca50b9c9a38f2379e6be6d87171fcd400fc14c8934b3bce96e2f  node-v26.13.1-darwin-x64.tar.gz
+2693310b2820f9350d29524f21344e1c623875bab773457d55b2aceb9670716f  node-v26.13.1-darwin-x64.tar.xz
+f4466bc8df8b13aff09762f70631f415e790d8b021eadc6e54affa20bc52d547  node-v26.13.1-headers.tar.gz
+02c39fd1ae84fdb2c5114ffff7cb3abefdf422c23546604882892ebf975818fc  node-v26.13.1-headers.tar.xz
+80a330b35415382878df18d41afbd106ea89bfb3be0087d6608e289a14c5cc7d  node-v26.13.1-linux-arm64.tar.gz
+89e1853138db51e8b82d3e98ba9c0d3f2956a28e5e55ea1b7e12d25aae92d5dd  node-v26.13.1-linux-arm64.tar.xz
+f958bba5e944344d4dd87305ebbaba55cdb5be58211a24f4f6a12a6ae6bd16ee  node-v26.13.1-linux-ppc64le.tar.gz
+06d5638602a919cb9a559eb92520862a387b4a0b170fed8883930b1eb392ec73  node-v26.13.1-linux-ppc64le.tar.xz
+f2baeb7be8821697e7038446bd8d06af164c0e8dcbc40439afe841dc68e6d8de  node-v26.13.1-linux-s390x.tar.gz
+2d65ece78005320dd13cccf15eeb30636a7352c18b92727f4b7c079de7d6969f  node-v26.13.1-linux-s390x.tar.xz
+baa23b6ecd8555804bf7a4e8702f1637203916a10d286d3ee16fce8bf5637b83  node-v26.13.1-linux-x64-musl.tar.gz
+c2ade3fc8a670f0b110eb68c020026daf1ac57b4fceed1ca471106fc144d8720  node-v26.13.1-linux-x64-musl.tar.xz
+518674de2b621728a5e4486f5fb3b7d2900bb3cc4aa97969edaa463db99f9778  node-v26.13.1-linux-x64.tar.gz
+5c063e46bab0fbc1c17cc445d7ff129cbdcd0471be6ed83b6ab864f8143bc864  node-v26.13.1-linux-x64.tar.xz
+39a029bc6548532c96eb7af1e2904d73d7fc368f699f3339a4c403546317af4e  node-v26.13.1.pkg
+60c6cdf11c3e9d5932fccd0eafae77f1152661584e129047684cb8646f228d3e  node-v26.13.1.tar.gz
+a7f6204ff63b6a2cd274d48903285abb86ed53a99070e532d4c2fd787457d9e6  node-v26.13.1.tar.xz
+db5ee0348e945b2e6d7721bcc5f3c1138eb15e5f484d74a8f4b3d37f7506b00a  node-v26.13.1-win-arm64.7z
+181ebe431b90787113a9e4fc80d38ce86d37888a353a0386de44d2872e48cb97  node-v26.13.1-win-arm64.zip
+472fddfebb740170c2ae7cd4faed5ee86c543c3a70ad2ebf8a9f01399d208472  node-v26.13.1-win-x64.7z
+e2edda75bfb089654705cf65a13b58933bfd5f57148e8ebda916f58a2474f1f7  node-v26.13.1-win-x64.zip
+0398ced8446e119478c724d1aa37c5afd6aa1a76fceab12787eb9714c5ed8b45  node-v26.13.1-x64.msi
+00edc356a01d7fe586beebe7519bb1acdff9dd62064ce4cf12ff1ed4a8d1810e  win-arm64/node.exe
+45084cbfc0170d7a30b29ab1eeeb2b0d770995ade0a13a4cc82cf31189f95c9f  win-arm64/node.lib
+c2a9dc12e52e46ab5030c0e9077fde45a9ec74d1dd0d3271edc8b2cd9d95671d  win-arm64/node_pdb.7z
+06094ea96323a63b4c5e52353e949dd051e760e6e615a802ba6a8ed068e3a739  win-arm64/node_pdb.zip
+f5109dc868ec38703ad8f305e0aceece717cb60d4889873f434017af4e96cccb  win-x64/node.exe
+caad0090dc3add94c06abd01e395e8ec0f1586c10071bda1f99480445d695f6f  win-x64/node.lib
+990a9af78a41f8e814cf4a1f270aaa1b2735761dcaf3f057e9efc1bf4a8e6a7d  win-x64/node_pdb.7z
+fe0338d99b79528991c3788ee0d0e3104d639775e31a6c39406d5ca67a0b09ab  win-x64/node_pdb.zip
+
+-----BEGIN PGP SIGNATURE-----
+
+iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSa9AAKCRAgsaOQsWjT
+Vh5oAP9u8Y21ggVtmKvswMRYIGosKkWTpwst08uzWLcpXZgbygEAx64vu2qYylXB
+rsE4UKrUL4LQWBASR0npRxfkhSHHtQs=
+=j8a2
+-----END PGP SIGNATURE-----
+```