Skip to content

feat(blog): create post for v26.13.1 #9327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aduh95 merged 1 commit into from
Nov 11, 2026
+131 −0
Merged

feat(blog): create post for v26.13.1 #9327

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 131 additions & 0 deletions apps/site/pages/en/blog/release/v26.13.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,131 @@
---
date: '2026-11-11T16:45:20.703Z'
category: release
title: Node.js 26.13.1 (LTS)
layout: blog-post
author: Antoine du Hamel
---

## 2026-11-11, Version 26.13.1 'Lithium' (LTS), @aduh95

This is a security release.

### Notable Changes

- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
- (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
- (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
- (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
- (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
- (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
- (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
- deps: update brotli to 1.2.1 (Node.js GitHub Bot)
- deps: update llhttp to 9.4.4 (Antoine du Hamel)
- deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
- deps: update undici to 8.12.4 (Node.js GitHub Bot)

### Commits

- \[[`7b777661f5`](https://github.com/nodejs/node/commit/7b777661f5)] - **build**: respect OpenSSL's configured API level (Filip Skokan) [#66953](https://github.com/nodejs/node/pull/66953)
- \[[`4518c7501f`](https://github.com/nodejs/node/commit/4518c7501f)] - **crypto**: fix builds with older OpenSSL 3.0 (Filip Skokan) [#66931](https://github.com/nodejs/node/pull/66931)
- \[[`94b73673b8`](https://github.com/nodejs/node/commit/94b73673b8)] - **deps**: brotli: cherry-pick e230f474b87 (liujiahui) [#61003](https://github.com/nodejs/node/pull/61003)
- \[[`e315236158`](https://github.com/nodejs/node/commit/e315236158)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038)
- \[[`8e714f7daa`](https://github.com/nodejs/node/commit/8e714f7daa)] - **deps**: update undici to 8.12.4 (Node.js GitHub Bot) [#67272](https://github.com/nodejs/node/pull/67272)
- \[[`af48b1a4d5`](https://github.com/nodejs/node/commit/af48b1a4d5)] - **deps**: update brotli to 1.2.1 (Node.js GitHub Bot) [#66990](https://github.com/nodejs/node/pull/66990)
- \[[`60316405bb`](https://github.com/nodejs/node/commit/60316405bb)] - **deps**: update undici to 8.12.3 (Node.js GitHub Bot) [#66993](https://github.com/nodejs/node/pull/66993)
- \[[`89b17baef4`](https://github.com/nodejs/node/commit/89b17baef4)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#66816](https://github.com/nodejs/node/pull/66816)
- \[[`d14db811c7`](https://github.com/nodejs/node/commit/d14db811c7)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001)
- \[[`9183db64fe`](https://github.com/nodejs/node/commit/9183db64fe)] - **http2**: retain streams during pending writes (Matteo Collina) [nodejs-private/node-private#1040](https://github.com/nodejs-private/node-private/pull/1040)
- \[[`62ae278a23`](https://github.com/nodejs/node/commit/62ae278a23)] - **http2**: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) [nodejs-private/node-private#1000](https://github.com/nodejs-private/node-private/pull/1000)
- \[[`7df134e2ce`](https://github.com/nodejs/node/commit/7df134e2ce)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017)
- \[[`0ff0cf6749`](https://github.com/nodejs/node/commit/0ff0cf6749)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026)
- \[[`a84a01ddb8`](https://github.com/nodejs/node/commit/a84a01ddb8)] - **http2**: avoid overflowing ALTSVC buffers (Matteo Collina) [nodejs-private/node-private#1035](https://github.com/nodejs-private/node-private/pull/1035)
- \[[`3fc67dc056`](https://github.com/nodejs/node/commit/3fc67dc056)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#66641](https://github.com/nodejs/node/pull/66641)
- \[[`df4011dafe`](https://github.com/nodejs/node/commit/df4011dafe)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#67252](https://github.com/nodejs/node/pull/67252)
- \[[`fa61009dc1`](https://github.com/nodejs/node/commit/fa61009dc1)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036)
- \[[`40d3d8ddca`](https://github.com/nodejs/node/commit/40d3d8ddca)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967)
- \[[`6c85b8e371`](https://github.com/nodejs/node/commit/6c85b8e371)] - **tls**: fix remotely reachable TLS server crash (Tim Perry) [nodejs-private/node-private#1018](https://github.com/nodejs-private/node-private/pull/1018)
- \[[`a8d6286949`](https://github.com/nodejs/node/commit/a8d6286949)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`e750e1fa02`](https://github.com/nodejs/node/commit/e750e1fa02)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`97b1357f08`](https://github.com/nodejs/node/commit/97b1357f08)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
- \[[`66e72ec604`](https://github.com/nodejs/node/commit/66e72ec604)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020)
- \[[`940cae5c33`](https://github.com/nodejs/node/commit/940cae5c33)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021)
- \[[`8232390dd8`](https://github.com/nodejs/node/commit/8232390dd8)] - **tools**: use vendored trust store in `shell.nix` (Antoine du Hamel) [#67318](https://github.com/nodejs/node/pull/67318)
- \[[`6c223db6e2`](https://github.com/nodejs/node/commit/6c223db6e2)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037)

Windows 64-bit Installer: https://nodejs.org/dist/v26.13.1/node-v26.13.1-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v26.13.1/node-v26.13.1-arm64.msi \
Windows 64-bit Binary: https://nodejs.org/dist/v26.13.1/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v26.13.1/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v26.13.1/node-v26.13.1.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-aix-ppc64.tar.gz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v26.13.1/node-v26.13.1-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v26.13.1/node-v26.13.1.tar.gz \
Other release files: https://nodejs.org/dist/v26.13.1/ \
Documentation: https://nodejs.org/docs/v26.13.1/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

65e55fb13dd6d9d43e2613526e72acb1bffcb2f3f185598d7b76e78ec237ad03 node-v26.13.1-aix-ppc64.tar.gz
7ec0190f09d3293afee0a5a5beea82638afb3c6fa41b7af14fdfe7524a865f0f node-v26.13.1-arm64.msi
aec2514ea1ceb2ba52455e9ec65986f6749a06dd759e5db2a72e6889668c9735 node-v26.13.1-darwin-arm64.tar.gz
af6202f5370a3a5209e85dc543758dfd9f44c8726626a236730cd603a67a8559 node-v26.13.1-darwin-arm64.tar.xz
82bb96078a24ca50b9c9a38f2379e6be6d87171fcd400fc14c8934b3bce96e2f node-v26.13.1-darwin-x64.tar.gz
2693310b2820f9350d29524f21344e1c623875bab773457d55b2aceb9670716f node-v26.13.1-darwin-x64.tar.xz
f4466bc8df8b13aff09762f70631f415e790d8b021eadc6e54affa20bc52d547 node-v26.13.1-headers.tar.gz
02c39fd1ae84fdb2c5114ffff7cb3abefdf422c23546604882892ebf975818fc node-v26.13.1-headers.tar.xz
80a330b35415382878df18d41afbd106ea89bfb3be0087d6608e289a14c5cc7d node-v26.13.1-linux-arm64.tar.gz
89e1853138db51e8b82d3e98ba9c0d3f2956a28e5e55ea1b7e12d25aae92d5dd node-v26.13.1-linux-arm64.tar.xz
f958bba5e944344d4dd87305ebbaba55cdb5be58211a24f4f6a12a6ae6bd16ee node-v26.13.1-linux-ppc64le.tar.gz
06d5638602a919cb9a559eb92520862a387b4a0b170fed8883930b1eb392ec73 node-v26.13.1-linux-ppc64le.tar.xz
f2baeb7be8821697e7038446bd8d06af164c0e8dcbc40439afe841dc68e6d8de node-v26.13.1-linux-s390x.tar.gz
2d65ece78005320dd13cccf15eeb30636a7352c18b92727f4b7c079de7d6969f node-v26.13.1-linux-s390x.tar.xz
baa23b6ecd8555804bf7a4e8702f1637203916a10d286d3ee16fce8bf5637b83 node-v26.13.1-linux-x64-musl.tar.gz
c2ade3fc8a670f0b110eb68c020026daf1ac57b4fceed1ca471106fc144d8720 node-v26.13.1-linux-x64-musl.tar.xz
518674de2b621728a5e4486f5fb3b7d2900bb3cc4aa97969edaa463db99f9778 node-v26.13.1-linux-x64.tar.gz
5c063e46bab0fbc1c17cc445d7ff129cbdcd0471be6ed83b6ab864f8143bc864 node-v26.13.1-linux-x64.tar.xz
39a029bc6548532c96eb7af1e2904d73d7fc368f699f3339a4c403546317af4e node-v26.13.1.pkg
60c6cdf11c3e9d5932fccd0eafae77f1152661584e129047684cb8646f228d3e node-v26.13.1.tar.gz
a7f6204ff63b6a2cd274d48903285abb86ed53a99070e532d4c2fd787457d9e6 node-v26.13.1.tar.xz
db5ee0348e945b2e6d7721bcc5f3c1138eb15e5f484d74a8f4b3d37f7506b00a node-v26.13.1-win-arm64.7z
181ebe431b90787113a9e4fc80d38ce86d37888a353a0386de44d2872e48cb97 node-v26.13.1-win-arm64.zip
472fddfebb740170c2ae7cd4faed5ee86c543c3a70ad2ebf8a9f01399d208472 node-v26.13.1-win-x64.7z
e2edda75bfb089654705cf65a13b58933bfd5f57148e8ebda916f58a2474f1f7 node-v26.13.1-win-x64.zip
0398ced8446e119478c724d1aa37c5afd6aa1a76fceab12787eb9714c5ed8b45 node-v26.13.1-x64.msi
00edc356a01d7fe586beebe7519bb1acdff9dd62064ce4cf12ff1ed4a8d1810e win-arm64/node.exe
45084cbfc0170d7a30b29ab1eeeb2b0d770995ade0a13a4cc82cf31189f95c9f win-arm64/node.lib
c2a9dc12e52e46ab5030c0e9077fde45a9ec74d1dd0d3271edc8b2cd9d95671d win-arm64/node_pdb.7z
06094ea96323a63b4c5e52353e949dd051e760e6e615a802ba6a8ed068e3a739 win-arm64/node_pdb.zip
f5109dc868ec38703ad8f305e0aceece717cb60d4889873f434017af4e96cccb win-x64/node.exe
caad0090dc3add94c06abd01e395e8ec0f1586c10071bda1f99480445d695f6f win-x64/node.lib
990a9af78a41f8e814cf4a1f270aaa1b2735761dcaf3f057e9efc1bf4a8e6a7d win-x64/node_pdb.7z
fe0338d99b79528991c3788ee0d0e3104d639775e31a6c39406d5ca67a0b09ab win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSa9AAKCRAgsaOQsWjT
Vh5oAP9u8Y21ggVtmKvswMRYIGosKkWTpwst08uzWLcpXZgbygEAx64vu2qYylXB
rsE4UKrUL4LQWBASR0npRxfkhSHHtQs=
=j8a2
-----END PGP SIGNATURE-----
```
Loading