diff --git a/apps/site/pages/en/blog/release/v24.22.3.md b/apps/site/pages/en/blog/release/v24.22.3.md new file mode 100644 index 0000000000000..ae87eede25e29 --- /dev/null +++ b/apps/site/pages/en/blog/release/v24.22.3.md @@ -0,0 +1,131 @@ +--- +date: '2026-11-11T16:45:11.877Z' +category: release +title: Node.js 24.22.3 (LTS) +layout: blog-post +author: Antoine du Hamel +--- + +## 2026-11-11, Version 24.22.3 'Krypton' (LTS), @aduh95 + +This is a security release. + +### Notable Changes + +- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High +- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High +- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High +- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High +- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High +- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High +- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High +- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High +- (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High +- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium +- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium +- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium +- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium +- (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium +- (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium +- (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low +- (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low +- (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low +- deps: update brotli to 1.2.1 (Node.js GitHub Bot) +- deps: update llhttp to 9.4.4 (Antoine du Hamel) +- deps: update sqlite to 3.54.1 (Node.js GitHub Bot) +- deps: update undici to 7.30.2 (Node.js GitHub Bot) + +### Commits + +- \[[`4c12b8a775`](https://github.com/nodejs/node/commit/4c12b8a775)] - **build**: respect OpenSSL's configured API level (Filip Skokan) [#66953](https://github.com/nodejs/node/pull/66953) +- \[[`5654932a7d`](https://github.com/nodejs/node/commit/5654932a7d)] - **crypto**: fix builds with older OpenSSL 3.0 (Filip Skokan) [#66931](https://github.com/nodejs/node/pull/66931) +- \[[`e88009c61c`](https://github.com/nodejs/node/commit/e88009c61c)] - **deps**: brotli: cherry-pick e230f474b87 (liujiahui) [#61003](https://github.com/nodejs/node/pull/61003) +- \[[`92e8d82e0e`](https://github.com/nodejs/node/commit/92e8d82e0e)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038) +- \[[`4164b5c2b4`](https://github.com/nodejs/node/commit/4164b5c2b4)] - **deps**: update brotli to 1.2.1 (Node.js GitHub Bot) [#66990](https://github.com/nodejs/node/pull/66990) +- \[[`4fec855b1d`](https://github.com/nodejs/node/commit/4fec855b1d)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#66816](https://github.com/nodejs/node/pull/66816) +- \[[`17c9eb75f3`](https://github.com/nodejs/node/commit/17c9eb75f3)] - **deps**: update sqlite to 3.54.0 (Node.js GitHub Bot) [#66663](https://github.com/nodejs/node/pull/66663) +- \[[`57ebbdc275`](https://github.com/nodejs/node/commit/57ebbdc275)] - **deps**: update undici to 7.30.2 (Node.js GitHub Bot) [#67273](https://github.com/nodejs/node/pull/67273) +- \[[`8749030ae5`](https://github.com/nodejs/node/commit/8749030ae5)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001) +- \[[`8e100ac90a`](https://github.com/nodejs/node/commit/8e100ac90a)] - **http2**: retain streams during pending writes (Matteo Collina) [nodejs-private/node-private#1040](https://github.com/nodejs-private/node-private/pull/1040) +- \[[`03f040685b`](https://github.com/nodejs/node/commit/03f040685b)] - **http2**: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) [nodejs-private/node-private#1000](https://github.com/nodejs-private/node-private/pull/1000) +- \[[`7be19aa614`](https://github.com/nodejs/node/commit/7be19aa614)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017) +- \[[`ff8938913b`](https://github.com/nodejs/node/commit/ff8938913b)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026) +- \[[`ae9ab37d62`](https://github.com/nodejs/node/commit/ae9ab37d62)] - **http2**: avoid overflowing ALTSVC buffers (Matteo Collina) [nodejs-private/node-private#1035](https://github.com/nodejs-private/node-private/pull/1035) +- \[[`a081fd3a3e`](https://github.com/nodejs/node/commit/a081fd3a3e)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#66641](https://github.com/nodejs/node/pull/66641) +- \[[`22f4367981`](https://github.com/nodejs/node/commit/22f4367981)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#67252](https://github.com/nodejs/node/pull/67252) +- \[[`4f60230182`](https://github.com/nodejs/node/commit/4f60230182)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036) +- \[[`fdbc6ab7ac`](https://github.com/nodejs/node/commit/fdbc6ab7ac)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967) +- \[[`d13a284de6`](https://github.com/nodejs/node/commit/d13a284de6)] - **src**: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/pull/986) +- \[[`c3485f2417`](https://github.com/nodejs/node/commit/c3485f2417)] - **tls**: fix remotely reachable TLS server crash (Tim Perry) [nodejs-private/node-private#1018](https://github.com/nodejs-private/node-private/pull/1018) +- \[[`599ca08e28`](https://github.com/nodejs/node/commit/599ca08e28)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030) +- \[[`981d2defc6`](https://github.com/nodejs/node/commit/981d2defc6)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030) +- \[[`799abe55cb`](https://github.com/nodejs/node/commit/799abe55cb)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030) +- \[[`45e3b1637a`](https://github.com/nodejs/node/commit/45e3b1637a)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020) +- \[[`25d487e3da`](https://github.com/nodejs/node/commit/25d487e3da)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021) +- \[[`e14e27b8d3`](https://github.com/nodejs/node/commit/e14e27b8d3)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037) + +Windows 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3-arm64.msi \ +Windows 64-bit Binary: https://nodejs.org/dist/v24.22.3/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.22.3/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-aix-ppc64.tar.gz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v24.22.3/node-v24.22.3.tar.gz \ +Other release files: https://nodejs.org/dist/v24.22.3/ \ +Documentation: https://nodejs.org/docs/v24.22.3/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +693fe88c4a85e7e172ec132f760e67b3925b2d6442cb1cb3a74b73fcf831f70a node-v24.22.3-aix-ppc64.tar.gz +6f36bfd098e103dc221ef9632c470a0879be88096c542d93c8802146d028da77 node-v24.22.3-arm64.msi +ff6e17d4874b76d272212b908cc020d6e815fba5a6c7eaaa06add725840307fd node-v24.22.3-darwin-arm64.tar.gz +1d64136c8a43d648d1b3bad10797a4c995b1ca032d2bde8799de43b37f058fe5 node-v24.22.3-darwin-arm64.tar.xz +977614af0504c81045e7fd85596dbca0e5f951b96681516dadafedcca8c447f7 node-v24.22.3-darwin-x64.tar.gz +4daeec962855c1a6e66cda398a25037319dc1bbd4a0939188b3547afbbfb6490 node-v24.22.3-darwin-x64.tar.xz +bc93bde109befc916a62348caae708a48f9550150d786398fea2d773607c18da node-v24.22.3-headers.tar.gz +6d99d3d799bd4c3807162e1bffc94749b723b65218e0328cf4e36262f9f8c4c3 node-v24.22.3-headers.tar.xz +261af2af250dfd7e9f25cf151d1b2713a0adf8f10a9ad116c4947f68627affe8 node-v24.22.3-linux-arm64.tar.gz +6e51a2ada00f0011cc266f65d98922b403d7ad88f809ca2aa615a5fe1ce6e86c node-v24.22.3-linux-arm64.tar.xz +ba4b26ade1f7b3f5ba6756856815de58e353746004e7e46cc838243a6cbf3299 node-v24.22.3-linux-ppc64le.tar.gz +c4b446699171f64763304a0bc6fb972b0fb4acb1de5358e52b4c52a95883593a node-v24.22.3-linux-ppc64le.tar.xz +d8f84397c1478c0ed0c1b29343626ed0f5f1a0985df0c5975c30f0c03836631f node-v24.22.3-linux-s390x.tar.gz +b5dbeb563ffb81946478fd765ae92efc21117e410e4e9b7d966bf59b00cee55d node-v24.22.3-linux-s390x.tar.xz +5499b663f62c72093715da98f4aea6f83427ad8bab9cf9c75f0924e0e456ce14 node-v24.22.3-linux-x64-musl.tar.gz +601b3e1930a593f3d44af2d0dca978dad4bd8b4594c4f8268b67a33553b04c30 node-v24.22.3-linux-x64-musl.tar.xz +061ec3e3062115705b56b51fa9cc330ab50d34b6969387d4e4b1a50c6809acc2 node-v24.22.3-linux-x64.tar.gz +4f2b175a6d53a5c617a80dba2676238a0688cef28c6da4eba35c7d844e66fcfb node-v24.22.3-linux-x64.tar.xz +0924690f44874cd8eff3ea0d436564c006fba207a76b567d6d4f3dbfdba9fd04 node-v24.22.3.pkg +4690edccae352134bbe31d844b37898f2a28b2c3d67901d0112fb6c4996d556a node-v24.22.3.tar.gz +48ca3aa8a9b02133356922ef4fc80200e00598c80a4ef446f7c39a459222593d node-v24.22.3.tar.xz +016edd23a1aaece30a2fe71bca92b46267db54ab83994f0fc77746aa60af29d2 node-v24.22.3-win-arm64.7z +b3cc74a295b39d4f273271e96f58c06dd2b35757ca12abec64c7d0598b434f14 node-v24.22.3-win-arm64.zip +e15e37b60cca7eeadad76e52515a19729c91fe7f4ed3dc3299ac66ce9dc940f7 node-v24.22.3-win-x64.7z +e612af99f626ab415ea225af6bce5c971feb448cb5cae250bb1c3fa50c5f7d9f node-v24.22.3-win-x64.zip +4a1ab5bdec5434bae58efae6c3e5077a011f6f1e76d2b47b7b10af043f7db545 node-v24.22.3-x64.msi +172e320db179ce416fc012b96b9917dacfb442beb081de57c4deaed7b5a24644 win-arm64/node.exe +2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d win-arm64/node.lib +9cb6f5186a808c153a46896843c9a5de91b57196aeb3825433a0e159be91518e win-arm64/node_pdb.7z +2939ce2c03c1ceee984eaf3b1d3c426781c5c968ed490a57806b2666b0ab0447 win-arm64/node_pdb.zip +86fc4785327db5f5c7558dc6156c543b433c313e813a222e088086222ab4afa6 win-x64/node.exe +a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7 win-x64/node.lib +96a5854ab8dc802a05418535a3ee89e50f2ae398a90e51a93f83b68e0ede902a win-x64/node_pdb.7z +f4324467a5dcfbd66eef4263a13ac4075ca745bf2e8347bfff464951ba644ac7 win-x64/node_pdb.zip + +-----BEGIN PGP SIGNATURE----- + +iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSaYgAKCRAgsaOQsWjT +Vv1pAP0bbPdYX8eujI8bGUA6hOUKT8e7rc6cmMiFwGCkZp1K+QEA25HJ/L/8Cuto +RrlePz93lZ6w4GnfGuavz+AQHTqy8gI= +=1jpr +-----END PGP SIGNATURE----- +```