feat(blog): create post for v22.23.5

Author: create-or-update-pull-request

apps/site/pages/en/blog/release/v22.23.5.md

@@ -0,0 +1,131 @@
+---
+date: '2026-11-11T16:44:58.310Z'
+category: release
+title: Node.js 22.23.5 (LTS)
+layout: blog-post
+author: Antoine du Hamel
+---
+
+## 2026-11-11, Version 22.23.5 'Jod' (LTS), @aduh95
+
+This is a security release.
+
+### Notable Changes
+
+- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
+- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
+- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
+- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
+- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
+- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
+- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
+- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
+- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
+- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
+- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
+- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
+- (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
+- (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
+- (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
+- (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
+- (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
+- deps: update llhttp to 9.4.4 (Antoine du Hamel)
+- deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
+
+### Commits
+
+- \[[`554fff40f0`](https://github.com/nodejs/node/commit/554fff40f0)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038)
+- \[[`6577cbf231`](https://github.com/nodejs/node/commit/6577cbf231)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#66816](https://github.com/nodejs/node/pull/66816)
+- \[[`61d93c6086`](https://github.com/nodejs/node/commit/61d93c6086)] - **deps**: update sqlite to 3.54.0 (Node.js GitHub Bot) [#66663](https://github.com/nodejs/node/pull/66663)
+- \[[`cd18f6bdff`](https://github.com/nodejs/node/commit/cd18f6bdff)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001)
+- \[[`6cd7e80d68`](https://github.com/nodejs/node/commit/6cd7e80d68)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017)
+- \[[`9bce421783`](https://github.com/nodejs/node/commit/9bce421783)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026)
+- \[[`30fd852c0d`](https://github.com/nodejs/node/commit/30fd852c0d)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#66641](https://github.com/nodejs/node/pull/66641)
+- \[[`21fb5d0348`](https://github.com/nodejs/node/commit/21fb5d0348)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#67252](https://github.com/nodejs/node/pull/67252)
+- \[[`af6fbb6564`](https://github.com/nodejs/node/commit/af6fbb6564)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036)
+- \[[`5c9eed3b1e`](https://github.com/nodejs/node/commit/5c9eed3b1e)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967)
+- \[[`5e497aec89`](https://github.com/nodejs/node/commit/5e497aec89)] - **src**: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/pull/986)
+- \[[`06af164d09`](https://github.com/nodejs/node/commit/06af164d09)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
+- \[[`209c7e4d83`](https://github.com/nodejs/node/commit/209c7e4d83)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
+- \[[`05e452f075`](https://github.com/nodejs/node/commit/05e452f075)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
+- \[[`67da864a89`](https://github.com/nodejs/node/commit/67da864a89)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020)
+- \[[`c841c6c7f1`](https://github.com/nodejs/node/commit/c841c6c7f1)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021)
+- \[[`ea159e84dd`](https://github.com/nodejs/node/commit/ea159e84dd)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037)
+
+Windows 32-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-x86.msi \
+Windows 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-x64.msi \
+Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-arm64.msi \
+Windows 32-bit Binary: https://nodejs.org/dist/v22.23.5/win-x86/node.exe \
+Windows 64-bit Binary: https://nodejs.org/dist/v22.23.5/win-x64/node.exe \
+Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.23.5/win-arm64/node.exe \
+macOS 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5.pkg \
+macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-darwin-arm64.tar.gz \
+macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-darwin-x64.tar.gz \
+Linux 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-x64.tar.xz \
+Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-ppc64le.tar.xz \
+Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-s390x.tar.xz \
+AIX 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-aix-ppc64.tar.gz \
+ARMv7 32-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-armv7l.tar.xz \
+ARMv8 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-arm64.tar.xz \
+Source Code: https://nodejs.org/dist/v22.23.5/node-v22.23.5.tar.gz \
+Other release files: https://nodejs.org/dist/v22.23.5/ \
+Documentation: https://nodejs.org/docs/v22.23.5/api/
+
+### SHASUMS
+
+```
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+f0dda0bae79678ab6eb3ca02179f4fe534463ce6f68ab942d2b49b057e478433  node-v22.23.5-aix-ppc64.tar.gz
+e01778455a929fa3b88ba102cca9527a9b39ca1c9fad1426c216e5e6d81b1a5a  node-v22.23.5-arm64.msi
+e7131995759b61a0170b646010d2ad35a5d37b4cb0d471f3e8317eac6f742f3d  node-v22.23.5-darwin-arm64.tar.gz
+d0c68c321161bb2c6483efea9a343010dea8e5e7f60d73c6a7eba140016d662f  node-v22.23.5-darwin-arm64.tar.xz
+c53383238206b9ae4db23c5d8a63645e2e753bec8ab51a49cc81939aa64e9422  node-v22.23.5-darwin-x64.tar.gz
+d68bf234a07781141dfca61ae4461c24560f70bd53223d76a41529eb02e8554e  node-v22.23.5-darwin-x64.tar.xz
+be890e343a72acd49e3b0491aefdc55400ed8a8fa29272d2d1ad19823e80035f  node-v22.23.5-headers.tar.gz
+ca152fdc8599c56eb2d1c44c58f5abf6dc97a69cddf94edcface9f727f608e1d  node-v22.23.5-headers.tar.xz
+8bd3dc69eee8f3f226315a80d7d1d4faccf217a4c8fae500168ac2e38f3bdba3  node-v22.23.5-linux-arm64.tar.gz
+2babb9eb5264860d540849f4b064a6fbdebcdc323657d9d382ce23d313fd5e09  node-v22.23.5-linux-arm64.tar.xz
+02cd221808721481ba3edd8b51624a391b45357543b8144e6ff7aac35e1500ac  node-v22.23.5-linux-armv7l.tar.gz
+1c3e15d38e4cafbbf74377ac070cd9d7e0418c673e1f6332f38f1d4762a699f9  node-v22.23.5-linux-armv7l.tar.xz
+de46a027eeb3942d589da63f2c5734e73d5c53aac8245e75088a1ac13bda2e04  node-v22.23.5-linux-ppc64le.tar.gz
+578bc696ade54f85439f6fdd5bd7695c2dea40d307565f573b9ea6ad7b1e5615  node-v22.23.5-linux-ppc64le.tar.xz
+50f8e113bf6638bb9d5ae6620883fd90b98e8e1f7af10ef87cca9dc979cdb39b  node-v22.23.5-linux-s390x.tar.gz
+210232af4b947a70880b985207cb307a8fb310b62c1925bdd971b0eaab96bde0  node-v22.23.5-linux-s390x.tar.xz
+83b8ba916eb22e89ba8274426a40f7aa0011c6e4c5ff77a5b03793f781a90786  node-v22.23.5-linux-x64-musl.tar.gz
+aef6690916d4b4210b55618ea0beeb927d67184257879b1ebec6e309285f3c08  node-v22.23.5-linux-x64-musl.tar.xz
+c54118104acc524633b5abe106bbf44a53126ec8b4e5fa105cb92b5d7de8a1a1  node-v22.23.5-linux-x64.tar.gz
+cdeb8670a0c81f51b4dc4ac61919f9b1ad917b304bf8221eb939570663d240f8  node-v22.23.5-linux-x64.tar.xz
+89fadefd7798158d8990ca9ed7dbb58f8ca7593adb92fe3da8a445db99415533  node-v22.23.5.pkg
+5ae198a2ec0513ea8b7ef28f71094c9a7931a44e4db17b1734d76fe958e0ff36  node-v22.23.5.tar.gz
+6cce7c58bf058700c643944903d60a325e8c9ceede1f5c2c088b435f2ada091a  node-v22.23.5.tar.xz
+f863a9fc7bd478d00aac4020cf9a75d81dba59ae078cc30c39bb0792a497cd96  node-v22.23.5-win-arm64.7z
+c1856817f611738c77534efbff8a5a17990593eab24046bc8d2c23a77a160d13  node-v22.23.5-win-arm64.zip
+aac7072c663c5efa2147aa7d51022d56efb1aa75c7dd0a3e7582501c692a045a  node-v22.23.5-win-x64.7z
+4a191082e9706866830379d577d2cc8a50c776fcd9436a8d061b063ed0d9a0e3  node-v22.23.5-win-x64.zip
+423dd2a38fbf7df6142242e7a10ee845389efe114577c47f359a28066deea2b5  node-v22.23.5-win-x86.7z
+9c01245683c87e3f81eedfbad82c1665611749627cd1b0b5a42921db9361b4a6  node-v22.23.5-win-x86.zip
+963a110509eca7e0d6cc009095ccb4117e26d59287876a056b79293ae3fef238  node-v22.23.5-x64.msi
+0118588f943cd620c66a688edca3d33231feeae2d0ae391cff0ef00e44d522e2  node-v22.23.5-x86.msi
+c2eaa48231229b966bfef21554df203221862a9fc94ec2a6908aad5eaa6c0ba0  win-arm64/node.exe
+5378f5bad777b4929d1cd4f58974e0ef03815ce5c159863f1875c4b434460c27  win-arm64/node.lib
+974f58f3978b9302a5f842979694c27ab3a544cc3e52bd9ab8e9ba0429be5aef  win-arm64/node_pdb.7z
+cbff923c9d6397394e119fb05437f28b31efdb90afcb519a655f987430a983f7  win-arm64/node_pdb.zip
+247e9693d316da9857e44990e5e11709f596f18112251b8026ec6eed80bdf38a  win-x64/node.exe
+c243185f2347870cadb637c909bf123fc703dc65dbfa769b17ec45a4b661d782  win-x64/node.lib
+03dabf86832838fbcb92816c11ee5fd59864c79573931177654b27dc7c4092ff  win-x64/node_pdb.7z
+82dd773a53ce2aaacaf41014ee81caa82e5bc2ed2b8e72f4764201c662b52995  win-x64/node_pdb.zip
+a6f12cfaa84f16d1cfb36ccca361e155acee9e8a4e47fdc3a684cda361ad245a  win-x86/node.exe
+eff47cc18fe2d3e40886cd49f04a85134681657d8b0f2afc55f363743cf6ddd7  win-x86/node.lib
+21a4e0bea77234963c96e14e01d147be604b320ee692c6927aff61f59418e59c  win-x86/node_pdb.7z
+0e417cff977767812ff81c98f420a514f83193e7ca799bcb1cff99a659a0b983  win-x86/node_pdb.zip
+
+-----BEGIN PGP SIGNATURE-----
+
+iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSZnAAKCRAgsaOQsWjT
+Vj01APwPC7+mOBYsepjXXr42B+d4UiWxpfUlX9PplsLbvTLojAD/TxXm1ctPiszb
+QS5t+HXqDJrH0/fKcE/e8ZY43hHZyAk=
+=W25e
+-----END PGP SIGNATURE-----
+```