From 9845b096e5a497776a068e2580b0c7bc4059bebe Mon Sep 17 00:00:00 2001 From: Create or Update Pull Request Action Date: Wed, 21 Oct 2026 10:39:13 +0000 Subject: [PATCH 1/2] feat(blog): create post for v22.23.4 --- apps/site/pages/en/blog/release/v22.23.4.md | 133 ++++++++++++++++++++ 1 file changed, 133 insertions(+) create mode 100644 apps/site/pages/en/blog/release/v22.23.4.md diff --git a/apps/site/pages/en/blog/release/v22.23.4.md b/apps/site/pages/en/blog/release/v22.23.4.md new file mode 100644 index 0000000000000..9980d5c347a99 --- /dev/null +++ b/apps/site/pages/en/blog/release/v22.23.4.md @@ -0,0 +1,133 @@ +--- +date: '2026-10-21T10:39:12.420Z' +category: release +title: Node.js 22.23.4 (LTS) +layout: blog-post +author: Antoine du Hamel +--- + +## 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95 + +This is a security release. + +### Notable Changes + +- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) +- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) +- (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina) +- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) +- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) +- (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) +- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) +- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) +- deps: update c-ares to 1.34.9 (Node.js GitHub Bot) +- deps: update timezone to 2026e (Node.js GitHub Bot) +- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) +- deps: update sqlite to 3.53.4 (Node.js GitHub Bot) +- deps: update undici to 6.29.1 (Node.js GitHub Bot) + +### Commits + +- \[[`68fa0df6d6`](https://github.com/nodejs/node/commit/68fa0df6d6)] - **crypto**: update root certificates to NSS 3.131.1 (Antoine du Hamel) [#66877](https://github.com/nodejs/node/pull/66877) +- \[[`dd6b47573b`](https://github.com/nodejs/node/commit/dd6b47573b)] - **crypto**: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-private/node-private/pull/987) +- \[[`a62b7d5362`](https://github.com/nodejs/node/commit/a62b7d5362)] - **crypto**: harden X.509 conversion and formatting (Filip Skokan) [nodejs-private/node-private#966](https://github.com/nodejs-private/node-private/pull/966) +- \[[`ec9e5e4a3e`](https://github.com/nodejs/node/commit/ec9e5e4a3e)] - **crypto**: update root certificates to NSS 3.129 (Node.js GitHub Bot) [#66496](https://github.com/nodejs/node/pull/66496) +- \[[`a538a9515d`](https://github.com/nodejs/node/commit/a538a9515d)] - **deps**: update c-ares to 1.34.9 (Node.js GitHub Bot) [#66868](https://github.com/nodejs/node/pull/66868) +- \[[`67d294739f`](https://github.com/nodejs/node/commit/67d294739f)] - **deps**: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002) +- \[[`1ab9db8a74`](https://github.com/nodejs/node/commit/1ab9db8a74)] - **deps**: update timezone to 2026e (Node.js GitHub Bot) [#66419](https://github.com/nodejs/node/pull/66419) +- \[[`52b4bcab03`](https://github.com/nodejs/node/commit/52b4bcab03)] - **deps**: update timezone to 2026d (Node.js GitHub Bot) [#66333](https://github.com/nodejs/node/pull/66333) +- \[[`60f4833d41`](https://github.com/nodejs/node/commit/60f4833d41)] - **deps**: update archs files for openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396) +- \[[`05470dc308`](https://github.com/nodejs/node/commit/05470dc308)] - **deps**: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396) +- \[[`47333fe4f4`](https://github.com/nodejs/node/commit/47333fe4f4)] - **deps**: update sqlite to 3.53.4 (Node.js GitHub Bot) [#64745](https://github.com/nodejs/node/pull/64745) +- \[[`98258b855f`](https://github.com/nodejs/node/commit/98258b855f)] - **deps**: update sqlite to 3.53.3 (Node.js GitHub Bot) [#64180](https://github.com/nodejs/node/pull/64180) +- \[[`a8349b6408`](https://github.com/nodejs/node/commit/a8349b6408)] - **deps**: update sqlite to 3.53.2 (Node.js GitHub Bot) [#63774](https://github.com/nodejs/node/pull/63774) +- \[[`e9e295bcc1`](https://github.com/nodejs/node/commit/e9e295bcc1)] - **deps**: cherry-pick e807d4e379 from SQLite (Junsu Han) [#63525](https://github.com/nodejs/node/pull/63525) +- \[[`512a9b61f0`](https://github.com/nodejs/node/commit/512a9b61f0)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#63217](https://github.com/nodejs/node/pull/63217) +- \[[`e708247254`](https://github.com/nodejs/node/commit/e708247254)] - **deps**: update sqlite to 3.53.0 (Node.js GitHub Bot) [#62699](https://github.com/nodejs/node/pull/62699) +- \[[`857be5afa3`](https://github.com/nodejs/node/commit/857be5afa3)] - **deps**: update undici to 6.29.1 (Node.js GitHub Bot) [#66765](https://github.com/nodejs/node/pull/66765) +- \[[`19c5056002`](https://github.com/nodejs/node/commit/19c5056002)] - **dns**: validate resolve inputs for null bytes (James M Snell) [nodejs-private/node-private#984](https://github.com/nodejs-private/node-private/pull/984) +- \[[`e7b2985d59`](https://github.com/nodejs/node/commit/e7b2985d59)] - **http**: ensure agent data guard works without I/O (James M Snell) [nodejs-private/node-private#983](https://github.com/nodejs-private/node-private/pull/983) +- \[[`50ab804edc`](https://github.com/nodejs/node/commit/50ab804edc)] - **permission**: check permission model in realpathSync (RafaelGSS) [nodejs-private/node-private#973](https://github.com/nodejs-private/node-private/pull/973) +- \[[`a18ec92752`](https://github.com/nodejs/node/commit/a18ec92752)] - **src**: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002) +- \[[`4342503fd8`](https://github.com/nodejs/node/commit/4342503fd8)] - **tls**: reject chains containing blocked public keys (Ulises Gascon) [#66871](https://github.com/nodejs/node/pull/66871) +- \[[`d7663560ac`](https://github.com/nodejs/node/commit/d7663560ac)] - **tls**: reject non-canonical IP addresses (Matteo Collina) [nodejs-private/node-private#982](https://github.com/nodejs-private/node-private/pull/982) +- \[[`beb4cd4cd3`](https://github.com/nodejs/node/commit/beb4cd4cd3)] - **tls**: match IPv6 hosts against IP-Address SANs (Pascal Garber) [#64145](https://github.com/nodejs/node/pull/64145) +- \[[`4b42e56aaf`](https://github.com/nodejs/node/commit/4b42e56aaf)] - **tools**: retry Gatekeeper check and stapling after notarization (Ryan Aslett) [#66855](https://github.com/nodejs/node/pull/66855) + +Windows 32-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-x86.msi \ +Windows 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-arm64.msi \ +Windows 32-bit Binary: https://nodejs.org/dist/v22.23.4/win-x86/node.exe \ +Windows 64-bit Binary: https://nodejs.org/dist/v22.23.4/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.23.4/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-aix-ppc64.tar.gz \ +ARMv7 32-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-armv7l.tar.xz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v22.23.4/node-v22.23.4.tar.gz \ +Other release files: https://nodejs.org/dist/v22.23.4/ \ +Documentation: https://nodejs.org/docs/v22.23.4/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +c219410bea0aed08ecfa5847a3d8aca4e45dd494a094f86c0d8721138360a9c9 node-v22.23.4-aix-ppc64.tar.gz +49edbb15812c13efa061c2c76b06944425f3711454845e78b625a8e865a45327 node-v22.23.4-arm64.msi +c9e1dbc748b33ed2d14f42445191ecaf14c56259c7a9a26d0042c49ec2b66428 node-v22.23.4-darwin-arm64.tar.gz +037650d0839f457747396f052073fb48333d31bf5abd3c98b74da20d89ebb1ad node-v22.23.4-darwin-arm64.tar.xz +efcc2b0db6f94bf53eddb038fe2b370277a042bd29e4f19b8f8e23598795b819 node-v22.23.4-darwin-x64.tar.gz +f42abca7aaac61efc57d49fb42ea84fc53bbeba9a749cb03a291ce6e4e7a69c1 node-v22.23.4-darwin-x64.tar.xz +dc4028dc105e27e5295119dd9da076fca71d5216113e097813f0fb30f59241a5 node-v22.23.4-headers.tar.gz +00615892b14ca159775ccb96d5696fdfeeea9804740fc8c5c1064eac09456a0e node-v22.23.4-headers.tar.xz +f7a1e486dbc8b286847815b477d4fb5e9fb963ed4489c3e1588853d685f589f9 node-v22.23.4-linux-arm64.tar.gz +6287aa46b6c375d816e63ae66d024fbbfd70404825aabdfdf898a970871d2f4b node-v22.23.4-linux-arm64.tar.xz +4318e0c68f62e18583dae85eb645f55c7f2b8a2e8d1fffe91a2e8abd046880ab node-v22.23.4-linux-armv7l.tar.gz +c9057c6a3b8fbb9651ed115c1e96d4a7281b7b9c9ca89fa05865c98ed7ffd437 node-v22.23.4-linux-armv7l.tar.xz +6684903ee2795aafe639dc07203e8a51ed20ae161cf21b6da7c213c8abfed442 node-v22.23.4-linux-ppc64le.tar.gz +e4732f45e0cad787d6ba70c4eb6db45dbdb3f286f67dee429dbc6b4ff36eac43 node-v22.23.4-linux-ppc64le.tar.xz +0bdc80fa27331e7f416d1d8553b9aabbc3c158709dc32859e4e85724ac1ac302 node-v22.23.4-linux-s390x.tar.gz +07ae074fc218fc42e24c939df0dc0209443fb08eb5b2ed6d26b1bf6757781fff node-v22.23.4-linux-s390x.tar.xz +63189402eaa222aabf51b4983e512592131cd2d4a9efc3ad9bf291fe74e3e4de node-v22.23.4-linux-x64-musl.tar.gz +38355b952f0392b91703d38a0d9af84eb0ff77d69828ca4bc8cc3bc3af80a720 node-v22.23.4-linux-x64-musl.tar.xz +b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406 node-v22.23.4-linux-x64.tar.gz +1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce node-v22.23.4-linux-x64.tar.xz +2095e4e478f01cfc1cd3784482bbb5bc67feab9bb21336b8934718bfc0f3b435 node-v22.23.4.pkg +4dd79de8cdc85d65cb32f48a75aee1067bf00bf94b96ecc8e4c2f82f6f0272c2 node-v22.23.4.tar.gz +7b9adc82d612d0a2a863d96c46de2292552e250cee51956ebbe0146c42aacae9 node-v22.23.4.tar.xz +a31b4be40d29f457dcd818563f2a3cf77f1ca35a15d3477cab38b3cc6d3a426a node-v22.23.4-win-arm64.7z +a8b8cd79cbbb3062435f449591d98dd63730bbbf30ce2d7cc3a6376c236cb111 node-v22.23.4-win-arm64.zip +010e51ccdd453d747ca67bfe8dda2c5da82540fa896ce2527f286d549574f975 node-v22.23.4-win-x64.7z +cbc74b5e0982c9dbb41525fd8fb5dcd32fbee237863f7829072f4639a1ce5f20 node-v22.23.4-win-x64.zip +b393001b81f7d478863394692bb57d28c0afe399fabbab3bce6016bb1cfa181f node-v22.23.4-win-x86.7z +7d6c4dce2ecccca46e3c4b3e43c8bebbd1969bd616fdb4fda1e8269171d9ccea node-v22.23.4-win-x86.zip +ca9303d3a12e8bec6de829fcb7812fc776930e0ce5c030328a24984ef928427e node-v22.23.4-x64.msi +c2a76d76eda52b7930b51fd490264c2fe34a094c04ae721bb71893f3fd6cd1d0 node-v22.23.4-x86.msi +64d9f6e69b4703870e8cd30a3477127df8b683ea04feb03660e439396549042a win-arm64/node.exe +5378f5bad777b4929d1cd4f58974e0ef03815ce5c159863f1875c4b434460c27 win-arm64/node.lib +8ad8a3ad402d8cf3bc760bf8ad03c85996ae6676a93407b6f06320ef5e981387 win-arm64/node_pdb.7z +4f94c9c8ab6a3ca4003e41ae226f191cb9ae837312d1390c14db94771a5abc94 win-arm64/node_pdb.zip +dccc52de28d8df2ee22d2062424f8c563070d95d8ad70c54c4bf01d590dec14f win-x64/node.exe +c243185f2347870cadb637c909bf123fc703dc65dbfa769b17ec45a4b661d782 win-x64/node.lib +c8496e103ee832fb8daf21af22b418c88558956457b9d850e95f78baf7f779cd win-x64/node_pdb.7z +426d3e46b15a918c561a15c2c99610d8edac752a406cf0b573809add0ff96f5d win-x64/node_pdb.zip +aa39a7741f62832ea50daba0113c8f8b12ccde226abca931326832d5bc47d31f win-x86/node.exe +eff47cc18fe2d3e40886cd49f04a85134681657d8b0f2afc55f363743cf6ddd7 win-x86/node.lib +2f5fcf07c631cff056ba53d4d8fb71d33d6302e243b7b267bfe3e226a3d76193 win-x86/node_pdb.7z +8aff266913d43a87103ebe02a4631148491b987ac2f70c6f3c95cf7e160de264 win-x86/node_pdb.zip + +-----BEGIN PGP SIGNATURE----- + +iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCatiU6AAKCRAgsaOQsWjT +VnXQAQDr+PrTYZtsgzxkf4LjsVlHCaVc9S8q5J1wHIcaNniLrwD/SCaZV98GQixc +dMdWJU0vUeZgB8Szb/eD1b3hcZmG3AY= +=vuXb +-----END PGP SIGNATURE----- +``` From 7b50db1b0cd11bb657b9cb3aa72b3088b4dc8455 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 21 Oct 2026 13:22:05 +0200 Subject: [PATCH 2/2] Apply suggestion from @aduh95 Signed-off-by: Antoine du Hamel --- apps/site/pages/en/blog/release/v22.23.4.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/apps/site/pages/en/blog/release/v22.23.4.md b/apps/site/pages/en/blog/release/v22.23.4.md index 9980d5c347a99..fb164b3b5e715 100644 --- a/apps/site/pages/en/blog/release/v22.23.4.md +++ b/apps/site/pages/en/blog/release/v22.23.4.md @@ -12,13 +12,12 @@ This is a security release. ### Notable Changes -- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) -- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) -- (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina) -- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) -- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) -- (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) -- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) +- (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High +- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High +- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High +- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium +- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium +- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) - deps: update timezone to 2026e (Node.js GitHub Bot)