Skip to content

feat(blog): create post for v24.22.3 #9326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aduh95 merged 1 commit into from
Nov 11, 2026
+131 −0
Merged

feat(blog): create post for v24.22.3 #9326

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 131 additions & 0 deletions apps/site/pages/en/blog/release/v24.22.3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,131 @@
---
date: '2026-11-11T16:45:11.877Z'
category: release
title: Node.js 24.22.3 (LTS)
layout: blog-post
author: Antoine du Hamel
---

## 2026-11-11, Version 24.22.3 'Krypton' (LTS), @aduh95

This is a security release.

### Notable Changes

- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
- (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
- (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
- (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
- (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
- (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
- (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
- deps: update brotli to 1.2.1 (Node.js GitHub Bot)
- deps: update llhttp to 9.4.4 (Antoine du Hamel)
- deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
- deps: update undici to 7.30.2 (Node.js GitHub Bot)

### Commits

- \[[`4c12b8a775`](https://github.com/nodejs/node/commit/4c12b8a775)] - **build**: respect OpenSSL's configured API level (Filip Skokan) [#66953](https://github.com/nodejs/node/pull/66953)
- \[[`5654932a7d`](https://github.com/nodejs/node/commit/5654932a7d)] - **crypto**: fix builds with older OpenSSL 3.0 (Filip Skokan) [#66931](https://github.com/nodejs/node/pull/66931)
- \[[`e88009c61c`](https://github.com/nodejs/node/commit/e88009c61c)] - **deps**: brotli: cherry-pick e230f474b87 (liujiahui) [#61003](https://github.com/nodejs/node/pull/61003)
- \[[`92e8d82e0e`](https://github.com/nodejs/node/commit/92e8d82e0e)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038)
- \[[`4164b5c2b4`](https://github.com/nodejs/node/commit/4164b5c2b4)] - **deps**: update brotli to 1.2.1 (Node.js GitHub Bot) [#66990](https://github.com/nodejs/node/pull/66990)
- \[[`4fec855b1d`](https://github.com/nodejs/node/commit/4fec855b1d)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#66816](https://github.com/nodejs/node/pull/66816)
- \[[`17c9eb75f3`](https://github.com/nodejs/node/commit/17c9eb75f3)] - **deps**: update sqlite to 3.54.0 (Node.js GitHub Bot) [#66663](https://github.com/nodejs/node/pull/66663)
- \[[`57ebbdc275`](https://github.com/nodejs/node/commit/57ebbdc275)] - **deps**: update undici to 7.30.2 (Node.js GitHub Bot) [#67273](https://github.com/nodejs/node/pull/67273)
- \[[`8749030ae5`](https://github.com/nodejs/node/commit/8749030ae5)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001)
- \[[`8e100ac90a`](https://github.com/nodejs/node/commit/8e100ac90a)] - **http2**: retain streams during pending writes (Matteo Collina) [nodejs-private/node-private#1040](https://github.com/nodejs-private/node-private/pull/1040)
- \[[`03f040685b`](https://github.com/nodejs/node/commit/03f040685b)] - **http2**: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) [nodejs-private/node-private#1000](https://github.com/nodejs-private/node-private/pull/1000)
- \[[`7be19aa614`](https://github.com/nodejs/node/commit/7be19aa614)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017)
- \[[`ff8938913b`](https://github.com/nodejs/node/commit/ff8938913b)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026)
- \[[`ae9ab37d62`](https://github.com/nodejs/node/commit/ae9ab37d62)] - **http2**: avoid overflowing ALTSVC buffers (Matteo Collina) [nodejs-private/node-private#1035](https://github.com/nodejs-private/node-private/pull/1035)
- \[[`a081fd3a3e`](https://github.com/nodejs/node/commit/a081fd3a3e)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#66641](https://github.com/nodejs/node/pull/66641)
- \[[`22f4367981`](https://github.com/nodejs/node/commit/22f4367981)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#67252](https://github.com/nodejs/node/pull/67252)
- \[[`4f60230182`](https://github.com/nodejs/node/commit/4f60230182)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036)
- \[[`fdbc6ab7ac`](https://github.com/nodejs/node/commit/fdbc6ab7ac)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967)
- \[[`d13a284de6`](https://github.com/nodejs/node/commit/d13a284de6)] - **src**: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/pull/986)
- \[[`c3485f2417`](https://github.com/nodejs/node/commit/c3485f2417)] - **tls**: fix remotely reachable TLS server crash (Tim Perry) [nodejs-private/node-private#1018](https://github.com/nodejs-private/node-private/pull/1018)
- \[[`599ca08e28`](https://github.com/nodejs/node/commit/599ca08e28)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`981d2defc6`](https://github.com/nodejs/node/commit/981d2defc6)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`799abe55cb`](https://github.com/nodejs/node/commit/799abe55cb)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`45e3b1637a`](https://github.com/nodejs/node/commit/45e3b1637a)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020)
- \[[`25d487e3da`](https://github.com/nodejs/node/commit/25d487e3da)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021)
- \[[`e14e27b8d3`](https://github.com/nodejs/node/commit/e14e27b8d3)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037)

Windows 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3-arm64.msi \
Windows 64-bit Binary: https://nodejs.org/dist/v24.22.3/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.22.3/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v24.22.3/node-v24.22.3.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-aix-ppc64.tar.gz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v24.22.3/node-v24.22.3-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v24.22.3/node-v24.22.3.tar.gz \
Other release files: https://nodejs.org/dist/v24.22.3/ \
Documentation: https://nodejs.org/docs/v24.22.3/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

693fe88c4a85e7e172ec132f760e67b3925b2d6442cb1cb3a74b73fcf831f70a node-v24.22.3-aix-ppc64.tar.gz
6f36bfd098e103dc221ef9632c470a0879be88096c542d93c8802146d028da77 node-v24.22.3-arm64.msi
ff6e17d4874b76d272212b908cc020d6e815fba5a6c7eaaa06add725840307fd node-v24.22.3-darwin-arm64.tar.gz
1d64136c8a43d648d1b3bad10797a4c995b1ca032d2bde8799de43b37f058fe5 node-v24.22.3-darwin-arm64.tar.xz
977614af0504c81045e7fd85596dbca0e5f951b96681516dadafedcca8c447f7 node-v24.22.3-darwin-x64.tar.gz
4daeec962855c1a6e66cda398a25037319dc1bbd4a0939188b3547afbbfb6490 node-v24.22.3-darwin-x64.tar.xz
bc93bde109befc916a62348caae708a48f9550150d786398fea2d773607c18da node-v24.22.3-headers.tar.gz
6d99d3d799bd4c3807162e1bffc94749b723b65218e0328cf4e36262f9f8c4c3 node-v24.22.3-headers.tar.xz
261af2af250dfd7e9f25cf151d1b2713a0adf8f10a9ad116c4947f68627affe8 node-v24.22.3-linux-arm64.tar.gz
6e51a2ada00f0011cc266f65d98922b403d7ad88f809ca2aa615a5fe1ce6e86c node-v24.22.3-linux-arm64.tar.xz
ba4b26ade1f7b3f5ba6756856815de58e353746004e7e46cc838243a6cbf3299 node-v24.22.3-linux-ppc64le.tar.gz
c4b446699171f64763304a0bc6fb972b0fb4acb1de5358e52b4c52a95883593a node-v24.22.3-linux-ppc64le.tar.xz
d8f84397c1478c0ed0c1b29343626ed0f5f1a0985df0c5975c30f0c03836631f node-v24.22.3-linux-s390x.tar.gz
b5dbeb563ffb81946478fd765ae92efc21117e410e4e9b7d966bf59b00cee55d node-v24.22.3-linux-s390x.tar.xz
5499b663f62c72093715da98f4aea6f83427ad8bab9cf9c75f0924e0e456ce14 node-v24.22.3-linux-x64-musl.tar.gz
601b3e1930a593f3d44af2d0dca978dad4bd8b4594c4f8268b67a33553b04c30 node-v24.22.3-linux-x64-musl.tar.xz
061ec3e3062115705b56b51fa9cc330ab50d34b6969387d4e4b1a50c6809acc2 node-v24.22.3-linux-x64.tar.gz
4f2b175a6d53a5c617a80dba2676238a0688cef28c6da4eba35c7d844e66fcfb node-v24.22.3-linux-x64.tar.xz
0924690f44874cd8eff3ea0d436564c006fba207a76b567d6d4f3dbfdba9fd04 node-v24.22.3.pkg
4690edccae352134bbe31d844b37898f2a28b2c3d67901d0112fb6c4996d556a node-v24.22.3.tar.gz
48ca3aa8a9b02133356922ef4fc80200e00598c80a4ef446f7c39a459222593d node-v24.22.3.tar.xz
016edd23a1aaece30a2fe71bca92b46267db54ab83994f0fc77746aa60af29d2 node-v24.22.3-win-arm64.7z
b3cc74a295b39d4f273271e96f58c06dd2b35757ca12abec64c7d0598b434f14 node-v24.22.3-win-arm64.zip
e15e37b60cca7eeadad76e52515a19729c91fe7f4ed3dc3299ac66ce9dc940f7 node-v24.22.3-win-x64.7z
e612af99f626ab415ea225af6bce5c971feb448cb5cae250bb1c3fa50c5f7d9f node-v24.22.3-win-x64.zip
4a1ab5bdec5434bae58efae6c3e5077a011f6f1e76d2b47b7b10af043f7db545 node-v24.22.3-x64.msi
172e320db179ce416fc012b96b9917dacfb442beb081de57c4deaed7b5a24644 win-arm64/node.exe
2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d win-arm64/node.lib
9cb6f5186a808c153a46896843c9a5de91b57196aeb3825433a0e159be91518e win-arm64/node_pdb.7z
2939ce2c03c1ceee984eaf3b1d3c426781c5c968ed490a57806b2666b0ab0447 win-arm64/node_pdb.zip
86fc4785327db5f5c7558dc6156c543b433c313e813a222e088086222ab4afa6 win-x64/node.exe
a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7 win-x64/node.lib
96a5854ab8dc802a05418535a3ee89e50f2ae398a90e51a93f83b68e0ede902a win-x64/node_pdb.7z
f4324467a5dcfbd66eef4263a13ac4075ca745bf2e8347bfff464951ba644ac7 win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSaYgAKCRAgsaOQsWjT
Vv1pAP0bbPdYX8eujI8bGUA6hOUKT8e7rc6cmMiFwGCkZp1K+QEA25HJ/L/8Cuto
RrlePz93lZ6w4GnfGuavz+AQHTqy8gI=
=1jpr
-----END PGP SIGNATURE-----
```
Loading