This is a security release.
Notable Changes
- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
- (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
- (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
- (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
- (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
- (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
- (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
- (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
- (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
- (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
- (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
- deps: update brotli to 1.2.1 (Node.js GitHub Bot)
- deps: update llhttp to 9.4.4 (Antoine du Hamel)
- deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
- deps: update undici to 8.12.4 (Node.js GitHub Bot)
Commits
- [
7b777661f5] - build: respect OpenSSL's configured API level (Filip Skokan) #66953 - [
4518c7501f] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931 - [
94b73673b8] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003 - [
e315236158] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038 - [
8e714f7daa] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272 - [
af48b1a4d5] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990 - [
60316405bb] - deps: update undici to 8.12.3 (Node.js GitHub Bot) #66993 - [
89b17baef4] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816 - [
d14db811c7] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001 - [
9183db64fe] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040 - [
62ae278a23] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000 - [
7df134e2ce] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017 - [
0ff0cf6749] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026 - [
a84a01ddb8] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035 - [
3fc67dc056] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641 - [
df4011dafe] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252 - [
fa61009dc1] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036 - [
40d3d8ddca] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967 - [
6c85b8e371] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018 - [
a8d6286949] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030 - [
e750e1fa02] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030 - [
97b1357f08] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030 - [
66e72ec604] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020 - [
940cae5c33] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021 - [
8232390dd8] - tools: use vendored trust store inshell.nix(Antoine du Hamel) #67318 - [
6c223db6e2] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037