This is a security release.
Notable Changes
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
- (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
- (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
- (CVE-2026-111497) src: expose
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) - (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- deps: update timezone to 2026e (Node.js GitHub Bot)
- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
- deps: update undici to 7.30.1 (Node.js GitHub Bot)
Commits
- [
2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 - [
4d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 - [
4b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007 - [
9243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 - [
1e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 - [
49dff6f57a] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 - [
fca511adc5] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008 - [
18711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419 - [
fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333 - [
b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 - [
ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 - [
1d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #66764 - [
843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 - [
96c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 - [
8dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 - [
b5f41529df] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#1002 - [
01acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #66871 - [
935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 - [
de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985 - [
9dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855