Skip to content

feat(blog): create post for v22.23.5 #9325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aduh95 merged 1 commit into from
Nov 11, 2026
Merged

feat(blog): create post for v22.23.5 #9325

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 131 additions & 0 deletions apps/site/pages/en/blog/release/v22.23.5.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,131 @@
---
date: '2026-11-11T16:44:58.310Z'
category: release
title: Node.js 22.23.5 (LTS)
layout: blog-post
author: Antoine du Hamel
---

## 2026-11-11, Version 22.23.5 'Jod' (LTS), @aduh95

This is a security release.

### Notable Changes

- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
- (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
- (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
- (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
- (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
- (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
- deps: update llhttp to 9.4.4 (Antoine du Hamel)
- deps: update sqlite to 3.54.1 (Node.js GitHub Bot)

### Commits

- \[[`554fff40f0`](https://github.com/nodejs/node/commit/554fff40f0)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038)
- \[[`6577cbf231`](https://github.com/nodejs/node/commit/6577cbf231)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#66816](https://github.com/nodejs/node/pull/66816)
- \[[`61d93c6086`](https://github.com/nodejs/node/commit/61d93c6086)] - **deps**: update sqlite to 3.54.0 (Node.js GitHub Bot) [#66663](https://github.com/nodejs/node/pull/66663)
- \[[`cd18f6bdff`](https://github.com/nodejs/node/commit/cd18f6bdff)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001)
- \[[`6cd7e80d68`](https://github.com/nodejs/node/commit/6cd7e80d68)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017)
- \[[`9bce421783`](https://github.com/nodejs/node/commit/9bce421783)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026)
- \[[`30fd852c0d`](https://github.com/nodejs/node/commit/30fd852c0d)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#66641](https://github.com/nodejs/node/pull/66641)
- \[[`21fb5d0348`](https://github.com/nodejs/node/commit/21fb5d0348)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#67252](https://github.com/nodejs/node/pull/67252)
- \[[`af6fbb6564`](https://github.com/nodejs/node/commit/af6fbb6564)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036)
- \[[`5c9eed3b1e`](https://github.com/nodejs/node/commit/5c9eed3b1e)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967)
- \[[`5e497aec89`](https://github.com/nodejs/node/commit/5e497aec89)] - **src**: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/pull/986)
- \[[`06af164d09`](https://github.com/nodejs/node/commit/06af164d09)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`209c7e4d83`](https://github.com/nodejs/node/commit/209c7e4d83)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`05e452f075`](https://github.com/nodejs/node/commit/05e452f075)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`67da864a89`](https://github.com/nodejs/node/commit/67da864a89)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020)
- \[[`c841c6c7f1`](https://github.com/nodejs/node/commit/c841c6c7f1)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021)
- \[[`ea159e84dd`](https://github.com/nodejs/node/commit/ea159e84dd)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037)

Windows 32-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-x86.msi \
Windows 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-arm64.msi \
Windows 32-bit Binary: https://nodejs.org/dist/v22.23.5/win-x86/node.exe \
Windows 64-bit Binary: https://nodejs.org/dist/v22.23.5/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.23.5/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-aix-ppc64.tar.gz \
ARMv7 32-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-armv7l.tar.xz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v22.23.5/node-v22.23.5.tar.gz \
Other release files: https://nodejs.org/dist/v22.23.5/ \
Documentation: https://nodejs.org/docs/v22.23.5/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

f0dda0bae79678ab6eb3ca02179f4fe534463ce6f68ab942d2b49b057e478433 node-v22.23.5-aix-ppc64.tar.gz
e01778455a929fa3b88ba102cca9527a9b39ca1c9fad1426c216e5e6d81b1a5a node-v22.23.5-arm64.msi
e7131995759b61a0170b646010d2ad35a5d37b4cb0d471f3e8317eac6f742f3d node-v22.23.5-darwin-arm64.tar.gz
d0c68c321161bb2c6483efea9a343010dea8e5e7f60d73c6a7eba140016d662f node-v22.23.5-darwin-arm64.tar.xz
c53383238206b9ae4db23c5d8a63645e2e753bec8ab51a49cc81939aa64e9422 node-v22.23.5-darwin-x64.tar.gz
d68bf234a07781141dfca61ae4461c24560f70bd53223d76a41529eb02e8554e node-v22.23.5-darwin-x64.tar.xz
be890e343a72acd49e3b0491aefdc55400ed8a8fa29272d2d1ad19823e80035f node-v22.23.5-headers.tar.gz
ca152fdc8599c56eb2d1c44c58f5abf6dc97a69cddf94edcface9f727f608e1d node-v22.23.5-headers.tar.xz
8bd3dc69eee8f3f226315a80d7d1d4faccf217a4c8fae500168ac2e38f3bdba3 node-v22.23.5-linux-arm64.tar.gz
2babb9eb5264860d540849f4b064a6fbdebcdc323657d9d382ce23d313fd5e09 node-v22.23.5-linux-arm64.tar.xz
02cd221808721481ba3edd8b51624a391b45357543b8144e6ff7aac35e1500ac node-v22.23.5-linux-armv7l.tar.gz
1c3e15d38e4cafbbf74377ac070cd9d7e0418c673e1f6332f38f1d4762a699f9 node-v22.23.5-linux-armv7l.tar.xz
de46a027eeb3942d589da63f2c5734e73d5c53aac8245e75088a1ac13bda2e04 node-v22.23.5-linux-ppc64le.tar.gz
578bc696ade54f85439f6fdd5bd7695c2dea40d307565f573b9ea6ad7b1e5615 node-v22.23.5-linux-ppc64le.tar.xz
50f8e113bf6638bb9d5ae6620883fd90b98e8e1f7af10ef87cca9dc979cdb39b node-v22.23.5-linux-s390x.tar.gz
210232af4b947a70880b985207cb307a8fb310b62c1925bdd971b0eaab96bde0 node-v22.23.5-linux-s390x.tar.xz
83b8ba916eb22e89ba8274426a40f7aa0011c6e4c5ff77a5b03793f781a90786 node-v22.23.5-linux-x64-musl.tar.gz
aef6690916d4b4210b55618ea0beeb927d67184257879b1ebec6e309285f3c08 node-v22.23.5-linux-x64-musl.tar.xz
c54118104acc524633b5abe106bbf44a53126ec8b4e5fa105cb92b5d7de8a1a1 node-v22.23.5-linux-x64.tar.gz
cdeb8670a0c81f51b4dc4ac61919f9b1ad917b304bf8221eb939570663d240f8 node-v22.23.5-linux-x64.tar.xz
89fadefd7798158d8990ca9ed7dbb58f8ca7593adb92fe3da8a445db99415533 node-v22.23.5.pkg
5ae198a2ec0513ea8b7ef28f71094c9a7931a44e4db17b1734d76fe958e0ff36 node-v22.23.5.tar.gz
6cce7c58bf058700c643944903d60a325e8c9ceede1f5c2c088b435f2ada091a node-v22.23.5.tar.xz
f863a9fc7bd478d00aac4020cf9a75d81dba59ae078cc30c39bb0792a497cd96 node-v22.23.5-win-arm64.7z
c1856817f611738c77534efbff8a5a17990593eab24046bc8d2c23a77a160d13 node-v22.23.5-win-arm64.zip
aac7072c663c5efa2147aa7d51022d56efb1aa75c7dd0a3e7582501c692a045a node-v22.23.5-win-x64.7z
4a191082e9706866830379d577d2cc8a50c776fcd9436a8d061b063ed0d9a0e3 node-v22.23.5-win-x64.zip
423dd2a38fbf7df6142242e7a10ee845389efe114577c47f359a28066deea2b5 node-v22.23.5-win-x86.7z
9c01245683c87e3f81eedfbad82c1665611749627cd1b0b5a42921db9361b4a6 node-v22.23.5-win-x86.zip
963a110509eca7e0d6cc009095ccb4117e26d59287876a056b79293ae3fef238 node-v22.23.5-x64.msi
0118588f943cd620c66a688edca3d33231feeae2d0ae391cff0ef00e44d522e2 node-v22.23.5-x86.msi
c2eaa48231229b966bfef21554df203221862a9fc94ec2a6908aad5eaa6c0ba0 win-arm64/node.exe
5378f5bad777b4929d1cd4f58974e0ef03815ce5c159863f1875c4b434460c27 win-arm64/node.lib
974f58f3978b9302a5f842979694c27ab3a544cc3e52bd9ab8e9ba0429be5aef win-arm64/node_pdb.7z
cbff923c9d6397394e119fb05437f28b31efdb90afcb519a655f987430a983f7 win-arm64/node_pdb.zip
247e9693d316da9857e44990e5e11709f596f18112251b8026ec6eed80bdf38a win-x64/node.exe
c243185f2347870cadb637c909bf123fc703dc65dbfa769b17ec45a4b661d782 win-x64/node.lib
03dabf86832838fbcb92816c11ee5fd59864c79573931177654b27dc7c4092ff win-x64/node_pdb.7z
82dd773a53ce2aaacaf41014ee81caa82e5bc2ed2b8e72f4764201c662b52995 win-x64/node_pdb.zip
a6f12cfaa84f16d1cfb36ccca361e155acee9e8a4e47fdc3a684cda361ad245a win-x86/node.exe
eff47cc18fe2d3e40886cd49f04a85134681657d8b0f2afc55f363743cf6ddd7 win-x86/node.lib
21a4e0bea77234963c96e14e01d147be604b320ee692c6927aff61f59418e59c win-x86/node_pdb.7z
0e417cff977767812ff81c98f420a514f83193e7ca799bcb1cff99a659a0b983 win-x86/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSZnAAKCRAgsaOQsWjT
Vj01APwPC7+mOBYsepjXXr42B+d4UiWxpfUlX9PplsLbvTLojAD/TxXm1ctPiszb
QS5t+HXqDJrH0/fKcE/e8ZY43hHZyAk=
=W25e
-----END PGP SIGNATURE-----
```
Loading