Skip to content

Commit dfeffae

Browse files
create-or-update-pull-requestcreate-or-update-pull-request
committed
feat(blog): create post for v24.22.3
1 parent c09d468 commit dfeffae

1 file changed

Lines changed: 131 additions & 0 deletions

File tree

‎apps/site/pages/en/blog/release/v24.22.3.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
---
2+
date: '2026-11-11T16:45:11.877Z'
3+
category: release
4+
title: Node.js 24.22.3 (LTS)
5+
layout: blog-post
6+
author: Antoine du Hamel
7+
---
8+
9+
## 2026-11-11, Version 24.22.3 'Krypton' (LTS), @aduh95
10+
11+
This is a security release.
12+
13+
### Notable Changes
14+
15+
- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
16+
- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
17+
- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
18+
- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
19+
- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
20+
- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
21+
- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
22+
- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
23+
- (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
24+
- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
25+
- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
26+
- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
27+
- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
28+
- (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
29+
- (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
30+
- (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
31+
- (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
32+
- (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
33+
- deps: update brotli to 1.2.1 (Node.js GitHub Bot)
34+
- deps: update llhttp to 9.4.4 (Antoine du Hamel)
35+
- deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
36+
- deps: update undici to 7.30.2 (Node.js GitHub Bot)
37+
38+
### Commits
39+
40+
- \[[`4c12b8a775`](https://github.com/nodejs/node/commit/4c12b8a775)] - **build**: respect OpenSSL's configured API level (Filip Skokan) [#66953](https://github.com/nodejs/node/pull/66953)
41+
- \[[`5654932a7d`](https://github.com/nodejs/node/commit/5654932a7d)] - **crypto**: fix builds with older OpenSSL 3.0 (Filip Skokan) [#66931](https://github.com/nodejs/node/pull/66931)
42+
- \[[`e88009c61c`](https://github.com/nodejs/node/commit/e88009c61c)] - **deps**: brotli: cherry-pick e230f474b87 (liujiahui) [#61003](https://github.com/nodejs/node/pull/61003)
43+
- \[[`92e8d82e0e`](https://github.com/nodejs/node/commit/92e8d82e0e)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038)
44+
- \[[`4164b5c2b4`](https://github.com/nodejs/node/commit/4164b5c2b4)] - **deps**: update brotli to 1.2.1 (Node.js GitHub Bot) [#66990](https://github.com/nodejs/node/pull/66990)
45+
- \[[`4fec855b1d`](https://github.com/nodejs/node/commit/4fec855b1d)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#66816](https://github.com/nodejs/node/pull/66816)
46+
- \[[`17c9eb75f3`](https://github.com/nodejs/node/commit/17c9eb75f3)] - **deps**: update sqlite to 3.54.0 (Node.js GitHub Bot) [#66663](https://github.com/nodejs/node/pull/66663)
47+
- \[[`57ebbdc275`](https://github.com/nodejs/node/commit/57ebbdc275)] - **deps**: update undici to 7.30.2 (Node.js GitHub Bot) [#67273](https://github.com/nodejs/node/pull/67273)
48+
- \[[`8749030ae5`](https://github.com/nodejs/node/commit/8749030ae5)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001)
49+
- \[[`8e100ac90a`](https://github.com/nodejs/node/commit/8e100ac90a)] - **http2**: retain streams during pending writes (Matteo Collina) [nodejs-private/node-private#1040](https://github.com/nodejs-private/node-private/pull/1040)
50+
- \[[`03f040685b`](https://github.com/nodejs/node/commit/03f040685b)] - **http2**: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) [nodejs-private/node-private#1000](https://github.com/nodejs-private/node-private/pull/1000)
51+
- \[[`7be19aa614`](https://github.com/nodejs/node/commit/7be19aa614)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017)
52+
- \[[`ff8938913b`](https://github.com/nodejs/node/commit/ff8938913b)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026)
53+
- \[[`ae9ab37d62`](https://github.com/nodejs/node/commit/ae9ab37d62)] - **http2**: avoid overflowing ALTSVC buffers (Matteo Collina) [nodejs-private/node-private#1035](https://github.com/nodejs-private/node-private/pull/1035)
54+
- \[[`a081fd3a3e`](https://github.com/nodejs/node/commit/a081fd3a3e)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#66641](https://github.com/nodejs/node/pull/66641)
55+
- \[[`22f4367981`](https://github.com/nodejs/node/commit/22f4367981)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#67252](https://github.com/nodejs/node/pull/67252)
56+
- \[[`4f60230182`](https://github.com/nodejs/node/commit/4f60230182)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036)
57+
- \[[`fdbc6ab7ac`](https://github.com/nodejs/node/commit/fdbc6ab7ac)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967)
58+
- \[[`d13a284de6`](https://github.com/nodejs/node/commit/d13a284de6)] - **src**: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/pull/986)
59+
- \[[`c3485f2417`](https://github.com/nodejs/node/commit/c3485f2417)] - **tls**: fix remotely reachable TLS server crash (Tim Perry) [nodejs-private/node-private#1018](https://github.com/nodejs-private/node-private/pull/1018)
60+
- \[[`599ca08e28`](https://github.com/nodejs/node/commit/599ca08e28)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
61+
- \[[`981d2defc6`](https://github.com/nodejs/node/commit/981d2defc6)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
62+
- \[[`799abe55cb`](https://github.com/nodejs/node/commit/799abe55cb)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
63+
- \[[`45e3b1637a`](https://github.com/nodejs/node/commit/45e3b1637a)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020)
64+
- \[[`25d487e3da`](https://github.com/nodejs/node/commit/25d487e3da)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021)
65+
- \[[`e14e27b8d3`](https://github.com/nodejs/node/commit/e14e27b8d3)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037)
66+
67+
Windows 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3-x64.msi \
68+
Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3-arm64.msi \
69+
Windows 64-bit Binary: https://nodejs.org/dist/v24.22.3/win-x64/node.exe \
70+
Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.22.3/win-arm64/node.exe \
71+
macOS 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3.pkg \
72+
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-darwin-arm64.tar.gz \
73+
macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-darwin-x64.tar.gz \
74+
Linux 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-x64.tar.xz \
75+
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-ppc64le.tar.xz \
76+
Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-s390x.tar.xz \
77+
AIX 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-aix-ppc64.tar.gz \
78+
ARMv8 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-arm64.tar.xz \
79+
Source Code: https://nodejs.org/dist/v24.22.3/node-v24.22.3.tar.gz \
80+
Other release files: https://nodejs.org/dist/v24.22.3/ \
81+
Documentation: https://nodejs.org/docs/v24.22.3/api/
82+
83+
### SHASUMS
84+
85+
```
86+
-----BEGIN PGP SIGNED MESSAGE-----
87+
Hash: SHA256
88+
89+
693fe88c4a85e7e172ec132f760e67b3925b2d6442cb1cb3a74b73fcf831f70a node-v24.22.3-aix-ppc64.tar.gz
90+
6f36bfd098e103dc221ef9632c470a0879be88096c542d93c8802146d028da77 node-v24.22.3-arm64.msi
91+
ff6e17d4874b76d272212b908cc020d6e815fba5a6c7eaaa06add725840307fd node-v24.22.3-darwin-arm64.tar.gz
92+
1d64136c8a43d648d1b3bad10797a4c995b1ca032d2bde8799de43b37f058fe5 node-v24.22.3-darwin-arm64.tar.xz
93+
977614af0504c81045e7fd85596dbca0e5f951b96681516dadafedcca8c447f7 node-v24.22.3-darwin-x64.tar.gz
94+
4daeec962855c1a6e66cda398a25037319dc1bbd4a0939188b3547afbbfb6490 node-v24.22.3-darwin-x64.tar.xz
95+
bc93bde109befc916a62348caae708a48f9550150d786398fea2d773607c18da node-v24.22.3-headers.tar.gz
96+
6d99d3d799bd4c3807162e1bffc94749b723b65218e0328cf4e36262f9f8c4c3 node-v24.22.3-headers.tar.xz
97+
261af2af250dfd7e9f25cf151d1b2713a0adf8f10a9ad116c4947f68627affe8 node-v24.22.3-linux-arm64.tar.gz
98+
6e51a2ada00f0011cc266f65d98922b403d7ad88f809ca2aa615a5fe1ce6e86c node-v24.22.3-linux-arm64.tar.xz
99+
ba4b26ade1f7b3f5ba6756856815de58e353746004e7e46cc838243a6cbf3299 node-v24.22.3-linux-ppc64le.tar.gz
100+
c4b446699171f64763304a0bc6fb972b0fb4acb1de5358e52b4c52a95883593a node-v24.22.3-linux-ppc64le.tar.xz
101+
d8f84397c1478c0ed0c1b29343626ed0f5f1a0985df0c5975c30f0c03836631f node-v24.22.3-linux-s390x.tar.gz
102+
b5dbeb563ffb81946478fd765ae92efc21117e410e4e9b7d966bf59b00cee55d node-v24.22.3-linux-s390x.tar.xz
103+
5499b663f62c72093715da98f4aea6f83427ad8bab9cf9c75f0924e0e456ce14 node-v24.22.3-linux-x64-musl.tar.gz
104+
601b3e1930a593f3d44af2d0dca978dad4bd8b4594c4f8268b67a33553b04c30 node-v24.22.3-linux-x64-musl.tar.xz
105+
061ec3e3062115705b56b51fa9cc330ab50d34b6969387d4e4b1a50c6809acc2 node-v24.22.3-linux-x64.tar.gz
106+
4f2b175a6d53a5c617a80dba2676238a0688cef28c6da4eba35c7d844e66fcfb node-v24.22.3-linux-x64.tar.xz
107+
0924690f44874cd8eff3ea0d436564c006fba207a76b567d6d4f3dbfdba9fd04 node-v24.22.3.pkg
108+
4690edccae352134bbe31d844b37898f2a28b2c3d67901d0112fb6c4996d556a node-v24.22.3.tar.gz
109+
48ca3aa8a9b02133356922ef4fc80200e00598c80a4ef446f7c39a459222593d node-v24.22.3.tar.xz
110+
016edd23a1aaece30a2fe71bca92b46267db54ab83994f0fc77746aa60af29d2 node-v24.22.3-win-arm64.7z
111+
b3cc74a295b39d4f273271e96f58c06dd2b35757ca12abec64c7d0598b434f14 node-v24.22.3-win-arm64.zip
112+
e15e37b60cca7eeadad76e52515a19729c91fe7f4ed3dc3299ac66ce9dc940f7 node-v24.22.3-win-x64.7z
113+
e612af99f626ab415ea225af6bce5c971feb448cb5cae250bb1c3fa50c5f7d9f node-v24.22.3-win-x64.zip
114+
4a1ab5bdec5434bae58efae6c3e5077a011f6f1e76d2b47b7b10af043f7db545 node-v24.22.3-x64.msi
115+
172e320db179ce416fc012b96b9917dacfb442beb081de57c4deaed7b5a24644 win-arm64/node.exe
116+
2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d win-arm64/node.lib
117+
9cb6f5186a808c153a46896843c9a5de91b57196aeb3825433a0e159be91518e win-arm64/node_pdb.7z
118+
2939ce2c03c1ceee984eaf3b1d3c426781c5c968ed490a57806b2666b0ab0447 win-arm64/node_pdb.zip
119+
86fc4785327db5f5c7558dc6156c543b433c313e813a222e088086222ab4afa6 win-x64/node.exe
120+
a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7 win-x64/node.lib
121+
96a5854ab8dc802a05418535a3ee89e50f2ae398a90e51a93f83b68e0ede902a win-x64/node_pdb.7z
122+
f4324467a5dcfbd66eef4263a13ac4075ca745bf2e8347bfff464951ba644ac7 win-x64/node_pdb.zip
123+
124+
-----BEGIN PGP SIGNATURE-----
125+
126+
iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSaYgAKCRAgsaOQsWjT
127+
Vv1pAP0bbPdYX8eujI8bGUA6hOUKT8e7rc6cmMiFwGCkZp1K+QEA25HJ/L/8Cuto
128+
RrlePz93lZ6w4GnfGuavz+AQHTqy8gI=
129+
=1jpr
130+
-----END PGP SIGNATURE-----
131+
```

0 commit comments

Comments
 (0)