This is a security release.
Notable Changes
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
- (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
- (CVE-2026-111497) src: expose
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) - (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- deps: update timezone to 2026e (Node.js GitHub Bot)
- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
- deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
- deps: update undici to 6.29.1 (Node.js GitHub Bot)
Commits
- [
68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 - [
dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 - [
a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966 - [
ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 - [
a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 - [
67d294739f] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 - [
1ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419 - [
52b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333 - [
60f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 - [
05470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 - [
47333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745 - [
98258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180 - [
a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774 - [
e9e295bcc1] - deps: cherry-pick e807d4e379 from SQLite (Junsu Han) #63525 - [
512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217 - [
e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699 - [
857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #66765 - [
19c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 - [
e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 - [
50ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 - [
a18ec92752] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#1002 - [
4342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871 - [
d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 - [
beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145 - [
4b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855