Skip to content

Commit ce7aaf1

Browse files
aduh95aduh95
committed
2026-10-21, Version 24.22.1 'Krypton' (LTS)
This is a security release. Notable changes: * (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) * (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) * (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) * (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina) * (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) * (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) * (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) * (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) * crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) * deps: update c-ares to 1.34.9 (Node.js GitHub Bot) * deps: update timezone to 2026e (Node.js GitHub Bot) * deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) * deps: update undici to 7.30.1 (Node.js GitHub Bot) PR-URL: nodejs-private/node-private#1012
1 parent 2a73ee5 commit ce7aaf1

3 files changed

Lines changed: 49 additions & 2 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@ release.
4040
</tr>
4141
<tr>
4242
<td valign="top">
43-
<b><a href="doc/changelogs/CHANGELOG_V24.md#24.22.0">24.22.0</a></b><br/>
43+
<b><a href="doc/changelogs/CHANGELOG_V24.md#24.22.1">24.22.1</a></b><br/>
44+
<a href="doc/changelogs/CHANGELOG_V24.md#24.22.0">24.22.0</a><br/>
4445
<a href="doc/changelogs/CHANGELOG_V24.md#24.21.0">24.21.0</a><br/>
4546
<a href="doc/changelogs/CHANGELOG_V24.md#24.20.0">24.20.0</a><br/>
4647
<a href="doc/changelogs/CHANGELOG_V24.md#24.19.0">24.19.0</a><br/>

‎doc/changelogs/CHANGELOG_V24.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
</tr>
1010
<tr>
1111
<td>
12+
<a href="#24.22.1">24.22.1</a><br/>
1213
<a href="#24.22.0">24.22.0</a><br/>
1314
<a href="#24.21.0">24.21.0</a><br/>
1415
<a href="#24.20.0">24.20.0</a><br/>
@@ -71,6 +72,51 @@
7172
* [io.js](CHANGELOG_IOJS.md)
7273
* [Archive](CHANGELOG_ARCHIVE.md)
7374

75+
<a id="24.22.1"></a>
76+
77+
## 2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95
78+
79+
This is a security release.
80+
81+
### Notable Changes
82+
83+
* (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
84+
* (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
85+
* (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
86+
* (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
87+
* (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
88+
* (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
89+
* (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel)
90+
* (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
91+
* crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
92+
* deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
93+
* deps: update timezone to 2026e (Node.js GitHub Bot)
94+
* deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
95+
* deps: update undici to 7.30.1 (Node.js GitHub Bot)
96+
97+
### Commits
98+
99+
* \[[`2a73ee5a89`](https://github.com/nodejs/node/commit/2a73ee5a89)] - **crypto**: update root certificates to NSS 3.131.1 (Antoine du Hamel) [#66877](https://github.com/nodejs/node/pull/66877)
100+
* \[[`4d6990b33c`](https://github.com/nodejs/node/commit/4d6990b33c)] - **crypto**: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-private/node-private/pull/987)
101+
* \[[`4b3c9bbf9f`](https://github.com/nodejs/node/commit/4b3c9bbf9f)] - **crypto**: harden X.509 conversion and formatting (Filip Skokan) [nodejs-private/node-private#1007](https://github.com/nodejs-private/node-private/pull/1007)
102+
* \[[`9243b105b6`](https://github.com/nodejs/node/commit/9243b105b6)] - **crypto**: update root certificates to NSS 3.129 (Node.js GitHub Bot) [#66496](https://github.com/nodejs/node/pull/66496)
103+
* \[[`1e39cd53c7`](https://github.com/nodejs/node/commit/1e39cd53c7)] - **deps**: update c-ares to 1.34.9 (Node.js GitHub Bot) [#66868](https://github.com/nodejs/node/pull/66868)
104+
* \[[`49dff6f57a`](https://github.com/nodejs/node/commit/49dff6f57a)] - **deps**: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002)
105+
* \[[`fca511adc5`](https://github.com/nodejs/node/commit/fca511adc5)] - **deps**: V8: backport 93cd21e8254b (Joyee Cheung) [nodejs-private/node-private#1008](https://github.com/nodejs-private/node-private/pull/1008)
106+
* \[[`18711c7567`](https://github.com/nodejs/node/commit/18711c7567)] - **deps**: update timezone to 2026e (Node.js GitHub Bot) [#66419](https://github.com/nodejs/node/pull/66419)
107+
* \[[`fa77cfb1ad`](https://github.com/nodejs/node/commit/fa77cfb1ad)] - **deps**: update timezone to 2026d (Node.js GitHub Bot) [#66333](https://github.com/nodejs/node/pull/66333)
108+
* \[[`b84f9f186b`](https://github.com/nodejs/node/commit/b84f9f186b)] - **deps**: update archs files for openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396)
109+
* \[[`ff0664c3ba`](https://github.com/nodejs/node/commit/ff0664c3ba)] - **deps**: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396)
110+
* \[[`1d4c89ef87`](https://github.com/nodejs/node/commit/1d4c89ef87)] - **deps**: update undici to 7.30.1 (Node.js GitHub Bot) [#66764](https://github.com/nodejs/node/pull/66764)
111+
* \[[`843a1627dc`](https://github.com/nodejs/node/commit/843a1627dc)] - **dns**: validate resolve inputs for null bytes (James M Snell) [nodejs-private/node-private#984](https://github.com/nodejs-private/node-private/pull/984)
112+
* \[[`96c3ccb1fc`](https://github.com/nodejs/node/commit/96c3ccb1fc)] - **http**: ensure agent data guard works without I/O (James M Snell) [nodejs-private/node-private#983](https://github.com/nodejs-private/node-private/pull/983)
113+
* \[[`8dc18a6218`](https://github.com/nodejs/node/commit/8dc18a6218)] - **permission**: check permission model in realpathSync (RafaelGSS) [nodejs-private/node-private#973](https://github.com/nodejs-private/node-private/pull/973)
114+
* \[[`b5f41529df`](https://github.com/nodejs/node/commit/b5f41529df)] - **src**: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002)
115+
* \[[`01acf0ee74`](https://github.com/nodejs/node/commit/01acf0ee74)] - **tls**: reject chains containing blocked public keys (Ulises Gascón) [#66871](https://github.com/nodejs/node/pull/66871)
116+
* \[[`935918e342`](https://github.com/nodejs/node/commit/935918e342)] - **tls**: reject non-canonical IP addresses (Matteo Collina) [nodejs-private/node-private#982](https://github.com/nodejs-private/node-private/pull/982)
117+
* \[[`de49c913f2`](https://github.com/nodejs/node/commit/de49c913f2)] - **tls**: fix ip normalization regression (James M Snell) [nodejs-private/node-private#985](https://github.com/nodejs-private/node-private/pull/985)
118+
* \[[`9dc4bb57f0`](https://github.com/nodejs/node/commit/9dc4bb57f0)] - **tools**: retry Gatekeeper check and stapling after notarization (Ryan Aslett) [#66855](https://github.com/nodejs/node/pull/66855)
119+
74120
<a id="24.22.0"></a>
75121

76122
## 2026-10-14, Version 24.22.0 'Krypton' (LTS), @richardlau prepared by @aduh95

‎src/node_version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
#define NODE_VERSION_IS_LTS 1
3030
#define NODE_VERSION_LTS_CODENAME "Krypton"
3131

32-
#define NODE_VERSION_IS_RELEASE 0
32+
#define NODE_VERSION_IS_RELEASE 1
3333

3434
#ifndef NODE_STRINGIFY
3535
#define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)

0 commit comments

Comments
 (0)