GitHub Release: nodejs/node v26.13.1 (11.11.2026)

This is a security release.

Notable Changes

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High


• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High


• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High


• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High


• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High


• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High


• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High


• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High


• (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High


• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium


• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium


• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium


• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium


• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium


• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium


• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low


• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low


• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low


• deps: update brotli to 1.2.1 (Node.js GitHub Bot)


• deps: update llhttp to 9.4.4 (Antoine du Hamel)


• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)


• deps: update undici to 8.12.4 (Node.js GitHub Bot)

Commits

• [7b777661f5] - build: respect OpenSSL's configured API level (Filip Skokan) #66953


• [4518c7501f] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931


• [94b73673b8] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003


• [e315236158] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038


• [8e714f7daa] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272


• [af48b1a4d5] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990


• [60316405bb] - deps: update undici to 8.12.3 (Node.js GitHub Bot) #66993


• [89b17baef4] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816


• [d14db811c7] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001


• [9183db64fe] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040


• [62ae278a23] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000


• [7df134e2ce] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017


• [0ff0cf6749] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026


• [a84a01ddb8] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035


• [3fc67dc056] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641


• [df4011dafe] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252


• [fa61009dc1] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036


• [40d3d8ddca] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967


• [6c85b8e371] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018


• [a8d6286949] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030


• [e750e1fa02] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030


• [97b1357f08] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030


• [66e72ec604] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020


• [940cae5c33] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021


• [8232390dd8] - tools: use vendored trust store in shell.nix (Antoine du Hamel) #67318


• [6c223db6e2] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037