diff --git a/apps/site/pages/en/blog/release/v24.22.1.md b/apps/site/pages/en/blog/release/v24.22.1.md new file mode 100644 index 0000000000000..9d44998e84931 --- /dev/null +++ b/apps/site/pages/en/blog/release/v24.22.1.md @@ -0,0 +1,115 @@ +--- +date: '2026-10-21T10:39:14.786Z' +category: release +title: Node.js 24.22.1 (LTS) +layout: blog-post +author: Antoine du Hamel +--- + +## 2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95 + +This is a security release. + +### Notable Changes + +- (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High +- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High +- (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High +- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High +- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium +- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium +- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low +- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) +- deps: update c-ares to 1.34.9 (Node.js GitHub Bot) +- deps: update timezone to 2026e (Node.js GitHub Bot) +- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) +- deps: update undici to 7.30.1 (Node.js GitHub Bot) + +### Commits + +- \[[`2a73ee5a89`](https://github.com/nodejs/node/commit/2a73ee5a89)] - **crypto**: update root certificates to NSS 3.131.1 (Antoine du Hamel) [#66877](https://github.com/nodejs/node/pull/66877) +- \[[`4d6990b33c`](https://github.com/nodejs/node/commit/4d6990b33c)] - **crypto**: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-private/node-private/pull/987) +- \[[`4b3c9bbf9f`](https://github.com/nodejs/node/commit/4b3c9bbf9f)] - **crypto**: harden X.509 conversion and formatting (Filip Skokan) [nodejs-private/node-private#1007](https://github.com/nodejs-private/node-private/pull/1007) +- \[[`9243b105b6`](https://github.com/nodejs/node/commit/9243b105b6)] - **crypto**: update root certificates to NSS 3.129 (Node.js GitHub Bot) [#66496](https://github.com/nodejs/node/pull/66496) +- \[[`1e39cd53c7`](https://github.com/nodejs/node/commit/1e39cd53c7)] - **deps**: update c-ares to 1.34.9 (Node.js GitHub Bot) [#66868](https://github.com/nodejs/node/pull/66868) +- \[[`49dff6f57a`](https://github.com/nodejs/node/commit/49dff6f57a)] - **deps**: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002) +- \[[`fca511adc5`](https://github.com/nodejs/node/commit/fca511adc5)] - **deps**: V8: backport 93cd21e8254b (Joyee Cheung) [nodejs-private/node-private#1008](https://github.com/nodejs-private/node-private/pull/1008) +- \[[`18711c7567`](https://github.com/nodejs/node/commit/18711c7567)] - **deps**: update timezone to 2026e (Node.js GitHub Bot) [#66419](https://github.com/nodejs/node/pull/66419) +- \[[`fa77cfb1ad`](https://github.com/nodejs/node/commit/fa77cfb1ad)] - **deps**: update timezone to 2026d (Node.js GitHub Bot) [#66333](https://github.com/nodejs/node/pull/66333) +- \[[`b84f9f186b`](https://github.com/nodejs/node/commit/b84f9f186b)] - **deps**: update archs files for openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396) +- \[[`ff0664c3ba`](https://github.com/nodejs/node/commit/ff0664c3ba)] - **deps**: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396) +- \[[`1d4c89ef87`](https://github.com/nodejs/node/commit/1d4c89ef87)] - **deps**: update undici to 7.30.1 (Node.js GitHub Bot) [#66764](https://github.com/nodejs/node/pull/66764) +- \[[`843a1627dc`](https://github.com/nodejs/node/commit/843a1627dc)] - **dns**: validate resolve inputs for null bytes (James M Snell) [nodejs-private/node-private#984](https://github.com/nodejs-private/node-private/pull/984) +- \[[`96c3ccb1fc`](https://github.com/nodejs/node/commit/96c3ccb1fc)] - **http**: ensure agent data guard works without I/O (James M Snell) [nodejs-private/node-private#983](https://github.com/nodejs-private/node-private/pull/983) +- \[[`8dc18a6218`](https://github.com/nodejs/node/commit/8dc18a6218)] - **permission**: check permission model in realpathSync (RafaelGSS) [nodejs-private/node-private#973](https://github.com/nodejs-private/node-private/pull/973) +- \[[`b5f41529df`](https://github.com/nodejs/node/commit/b5f41529df)] - **src**: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002) +- \[[`01acf0ee74`](https://github.com/nodejs/node/commit/01acf0ee74)] - **tls**: reject chains containing blocked public keys (Ulises Gascón) [#66871](https://github.com/nodejs/node/pull/66871) +- \[[`935918e342`](https://github.com/nodejs/node/commit/935918e342)] - **tls**: reject non-canonical IP addresses (Matteo Collina) [nodejs-private/node-private#982](https://github.com/nodejs-private/node-private/pull/982) +- \[[`de49c913f2`](https://github.com/nodejs/node/commit/de49c913f2)] - **tls**: fix ip normalization regression (James M Snell) [nodejs-private/node-private#985](https://github.com/nodejs-private/node-private/pull/985) +- \[[`9dc4bb57f0`](https://github.com/nodejs/node/commit/9dc4bb57f0)] - **tools**: retry Gatekeeper check and stapling after notarization (Ryan Aslett) [#66855](https://github.com/nodejs/node/pull/66855) + +Windows 64-bit Installer: https://nodejs.org/dist/v24.22.1/node-v24.22.1-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.22.1/node-v24.22.1-arm64.msi \ +Windows 64-bit Binary: https://nodejs.org/dist/v24.22.1/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.22.1/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v24.22.1/node-v24.22.1.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v24.22.1/node-v24.22.1-aix-ppc64.tar.gz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v24.22.1/node-v24.22.1.tar.gz \ +Other release files: https://nodejs.org/dist/v24.22.1/ \ +Documentation: https://nodejs.org/docs/v24.22.1/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +f627b6d079829e648a4b800ffa889d37dbe23913507030030db85aa861591a26 node-v24.22.1-aix-ppc64.tar.gz +5faf40b7cba01eba47dfff7b5322979f27d0e8f042bab96cc567a3df01ec9796 node-v24.22.1-arm64.msi +89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7 node-v24.22.1-darwin-arm64.tar.gz +654ba79de6155647e22321932b45f2a1ccb705976cc337c9b8e278beb085a628 node-v24.22.1-darwin-arm64.tar.xz +d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035 node-v24.22.1-darwin-x64.tar.gz +65e450f90a6eaacd5000f611861c4ce65fadc87f813795dc4ed0c0e5f2fca2d4 node-v24.22.1-darwin-x64.tar.xz +322e0a27db9088093ab8347bdc8c7e0aaa21dc9ed548390bf06b394494c09267 node-v24.22.1-headers.tar.gz +33bf331af1c9812d25f82efb53de793b36b54c23b8ad49652c4325bbe7f98216 node-v24.22.1-headers.tar.xz +33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3 node-v24.22.1-linux-arm64.tar.gz +dbabf7a1cbf947e6059ffad2c27b80041db97dea1e553b62afdee7f13fca336e node-v24.22.1-linux-arm64.tar.xz +9ce5728445016b29e49ad098f7a336061aa5f770d177d927278bc26fd626e643 node-v24.22.1-linux-ppc64le.tar.gz +5939d9e66b5a7e58c97f2a287787c5151147f33d43c41ad3261254b148374fdf node-v24.22.1-linux-ppc64le.tar.xz +71979aeb1c385bc8ee83100d383a3b1ec0a5202e03df9f996a70403309caffb5 node-v24.22.1-linux-s390x.tar.gz +339aa21a40c321a2af55b7f7547117250b3d6f8149568bca59b5e17c2931ac22 node-v24.22.1-linux-s390x.tar.xz +9b250d29d6ab8ae38dd23019e2c04a6d6b2916ab1dad721c5f6e1da2b2901c6a node-v24.22.1-linux-x64-musl.tar.gz +b83b6d679e4bf1128c8e9e982f3e64cd8badaddf1e38613aa36f93186395f9fa node-v24.22.1-linux-x64-musl.tar.xz +eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c node-v24.22.1-linux-x64.tar.gz +6c172a9ab6718f7b801fb5a7bd486af2ee5e32758086a04b84fcce2aa77095e6 node-v24.22.1-linux-x64.tar.xz +ca7618402754944626787fca386c406a041541f097da172e92348d8b1e44e48b node-v24.22.1.pkg +001773d9bd53fbd27a25efd42aa6a9693ebfe500998ca9bec635e9b6ee79bc91 node-v24.22.1.tar.gz +4f5379796280cdaeb0c2f358fd04b6a16cc4fb7dfa83b5a8c91a9d963b435231 node-v24.22.1.tar.xz +aa26929d4ca7754aac3bd7fd018eb5c1c7961d00adf8aebf35c435d66edef62e node-v24.22.1-win-arm64.7z +a0c807319fede24c4a0d8f84564c82a619bd313b16b10c007c383c2609e99171 node-v24.22.1-win-arm64.zip +bf9245db3a3bb281da45fee3974a74403687ea6030587bee4fd992efc822c35c node-v24.22.1-win-x64.7z +d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5 node-v24.22.1-win-x64.zip +3bda4baf1ee709b33cf920dd633106ddb23951e322bff9c03ec9f64ab8981b01 node-v24.22.1-x64.msi +8bea91dc437fe01e7d92ef0efc6c9eaf654369aaba9b2d3e9841552ea7b95a00 win-arm64/node.exe +2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d win-arm64/node.lib +ba8f5888df95f14c9de399863d2f8be82f05b4ad40d6ac390c00c8027c755486 win-arm64/node_pdb.7z +60f345bf8f9cbbfce57a97ebccd11433356bbb6f39ecbd23ca2eb51c6303a180 win-arm64/node_pdb.zip +d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5 win-x64/node.exe +a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7 win-x64/node.lib +75653d93bc58a9ae2d6bd419130126d881e27f804fd9e2cd0356696fe1f1a328 win-x64/node_pdb.7z +d61a585824e5504e1dfa0ceb7ad6981176f59531500303a97b790ccfe248a2c1 win-x64/node_pdb.zip + +-----BEGIN PGP SIGNATURE----- + +iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCatiVbQAKCRAgsaOQsWjT +VsbAAQD1dxxGKpYhXszjCyau6srZaTCrvidfCFMXEG2uDG+9gAEA1x/U+J1rUUVw +wRP69XQlBX/P1htt1WNCKiGnPxSZBQ8= +=yktz +-----END PGP SIGNATURE----- +```