From 042ba1cd5c6f562ff3518af45b1a302cb572794e Mon Sep 17 00:00:00 2001 From: Create or Update Pull Request Action Date: Wed, 21 Oct 2026 10:39:21 +0000 Subject: [PATCH 1/2] feat(blog): create post for v26.12.1 --- apps/site/pages/en/blog/release/v26.12.1.md | 117 ++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 apps/site/pages/en/blog/release/v26.12.1.md diff --git a/apps/site/pages/en/blog/release/v26.12.1.md b/apps/site/pages/en/blog/release/v26.12.1.md new file mode 100644 index 0000000000000..bea749aac8474 --- /dev/null +++ b/apps/site/pages/en/blog/release/v26.12.1.md @@ -0,0 +1,117 @@ +--- +date: '2026-10-21T10:39:20.400Z' +category: release +title: Node.js 26.12.1 (Current) +layout: blog-post +author: Antoine du Hamel +--- + +## 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS + +This is a security release. + +### Notable Changes + +- (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High +- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High +- (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High +- (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) – High +- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High +- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium +- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium +- (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low +- (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low +- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low +- deps: V8: backport 93cd21e8254b (Joyee Cheung) +- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) +- tls: reject chains containing blocked public keys (Ulises Gascon) +- deps: update c-ares to 1.34.9 (Node.js GitHub Bot) +- tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) +- crypto: harden X.509 conversion and formatting (Filip Skokan) + +### Commits + +- \[[`818e4ca061`](https://github.com/nodejs/node/commit/818e4ca061)] - **crypto**: update root certificates to NSS 3.131.1 (Antoine du Hamel) [#66877](https://github.com/nodejs/node/pull/66877) +- \[[`fd3c87ed43`](https://github.com/nodejs/node/commit/fd3c87ed43)] - **crypto**: harden X.509 conversion and formatting (Filip Skokan) [nodejs-private/node-private#966](https://github.com/nodejs-private/node-private/pull/966) +- \[[`acffa610db`](https://github.com/nodejs/node/commit/acffa610db)] - **crypto**: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-private/node-private/pull/987) +- \[[`7895a5cd2d`](https://github.com/nodejs/node/commit/7895a5cd2d)] - **deps**: update undici to 8.12.2 (Node.js GitHub Bot) [#66721](https://github.com/nodejs/node/pull/66721) +- \[[`12daa54d2e`](https://github.com/nodejs/node/commit/12daa54d2e)] - **deps**: V8: backport 93cd21e8254b (Joyee Cheung) [nodejs-private/node-private#999](https://github.com/nodejs-private/node-private/pull/999) +- \[[`6a8b3db7e2`](https://github.com/nodejs/node/commit/6a8b3db7e2)] - **deps**: update c-ares to 1.34.9 (Node.js GitHub Bot) [#66868](https://github.com/nodejs/node/pull/66868) +- \[[`a6040b50d9`](https://github.com/nodejs/node/commit/a6040b50d9)] - **deps**: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002) +- \[[`6b78ea171d`](https://github.com/nodejs/node/commit/6b78ea171d)] - **dns**: validate resolve inputs for null bytes (James M Snell) [nodejs-private/node-private#984](https://github.com/nodejs-private/node-private/pull/984) +- \[[`0683ee5f7d`](https://github.com/nodejs/node/commit/0683ee5f7d)] - **http**: ensure agent data guard works without I/O (James M Snell) [nodejs-private/node-private#983](https://github.com/nodejs-private/node-private/pull/983) +- \[[`e5cae10148`](https://github.com/nodejs/node/commit/e5cae10148)] - _**Revert**_ "**module**: synchronously load most ES modules" (Antoine du Hamel) [#66786](https://github.com/nodejs/node/pull/66786) +- \[[`cc244131aa`](https://github.com/nodejs/node/commit/cc244131aa)] - **permission**: check permission model in realpathSync (RafaelGSS) [nodejs-private/node-private#973](https://github.com/nodejs-private/node-private/pull/973) +- \[[`0392385841`](https://github.com/nodejs/node/commit/0392385841)] - **src**: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002) +- \[[`c273a408c9`](https://github.com/nodejs/node/commit/c273a408c9)] - **src**: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/pull/986) +- \[[`a2caddd20e`](https://github.com/nodejs/node/commit/a2caddd20e)] - **tls**: reject chains containing blocked public keys (Ulises Gascon) [#66871](https://github.com/nodejs/node/pull/66871) +- \[[`ad788ccd07`](https://github.com/nodejs/node/commit/ad788ccd07)] - **tls**: reject non-canonical IP addresses (Matteo Collina) [nodejs-private/node-private#982](https://github.com/nodejs-private/node-private/pull/982) +- \[[`cd4b05469c`](https://github.com/nodejs/node/commit/cd4b05469c)] - **tls**: fix ip normalization regression (James M Snell) [nodejs-private/node-private#985](https://github.com/nodejs-private/node-private/pull/985) +- \[[`5fa440e0d7`](https://github.com/nodejs/node/commit/5fa440e0d7)] - **tools**: retry Gatekeeper check and stapling after notarization (Ryan Aslett) [#66855](https://github.com/nodejs/node/pull/66855) +- \[[`745ad77156`](https://github.com/nodejs/node/commit/745ad77156)] - **zlib**: avoid caching invalid ZIP local headers (Matteo Collina) [nodejs-private/node-private#981](https://github.com/nodejs-private/node-private/pull/981) + +Windows 64-bit Installer: https://nodejs.org/dist/v26.12.1/node-v26.12.1-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v26.12.1/node-v26.12.1-arm64.msi \ +Windows 64-bit Binary: https://nodejs.org/dist/v26.12.1/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v26.12.1/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v26.12.1/node-v26.12.1.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v26.12.1/node-v26.12.1-aix-ppc64.tar.gz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v26.12.1/node-v26.12.1.tar.gz \ +Other release files: https://nodejs.org/dist/v26.12.1/ \ +Documentation: https://nodejs.org/docs/v26.12.1/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +0cb96e6f4091b647b66f811030d5c4bf0d0a6e6f47e41e124817b644caff91c1 node-v26.12.1-aix-ppc64.tar.gz +2be19b26651210b2541b6872f85d43f31422b9e624d82aaad8baa77ead294d88 node-v26.12.1-arm64.msi +1901d539912c02afa10d1cc126943a8855a7eedebe830119463470db5e6c59e8 node-v26.12.1-darwin-arm64.tar.gz +18830bf448fe187c650dc28c98aa8c968ed1d40b6dd032c081e70a384a1bf660 node-v26.12.1-darwin-arm64.tar.xz +b85c2ea4420ad0bc4abf2dc6cf1f55130ed681f1cabf60cf3f526e4c9e2712ff node-v26.12.1-darwin-x64.tar.gz +69316aaafb4dfcb25ac7b9a460f5c60928a37580284fde410144d0e6c8672d0f node-v26.12.1-darwin-x64.tar.xz +a983cdcea96e85d137b9b807cc776bb5564fc9e3e1c9185d59bbfaa781efd08f node-v26.12.1-headers.tar.gz +30fe7d9c02f60260ee406c75088d52234e7e9b32833755e3a65c86f9d200fe0b node-v26.12.1-headers.tar.xz +a6c01af459dd8972ab3fb08ee5da81244d26ba8c4944a62d5bbba8c597ae154f node-v26.12.1-linux-arm64.tar.gz +42aa04922591ee5d4dbc7740d452621acf28508239daa512f5ee8c47ee224fdb node-v26.12.1-linux-arm64.tar.xz +9671579d458731feab017f9b199f2150054ab71910a2d6cdf3540042851b3270 node-v26.12.1-linux-ppc64le.tar.gz +35a88a7188738ed64239e1312bf0d4eb786afa8d8a5652299799ca256ac72425 node-v26.12.1-linux-ppc64le.tar.xz +da82b4f4705994d2f92291e34ad736207a5a6b8b139b69393875d81302ed79d8 node-v26.12.1-linux-s390x.tar.gz +1082e689c5c30bf48f6176c38fe1e2657f4ac6bdf4c1bed1c13fbbb8d38b64c2 node-v26.12.1-linux-s390x.tar.xz +43c406e3ca88148b59681a07bb946edc75de005d5ef48b99835222cf2c87893d node-v26.12.1-linux-x64-musl.tar.gz +4fd7c15fdc930ea48cf144bb302ce30a76c81920e36473d087720d0810efe1cd node-v26.12.1-linux-x64-musl.tar.xz +0fd1eb7770598f52a21995edf6ed35fc690400fa437c2386af329519e9143132 node-v26.12.1-linux-x64.tar.gz +6170b2d474e1c626f43cff3adc118df9fe3b573258a4fc3d850c8dbc6b079bbd node-v26.12.1-linux-x64.tar.xz +eb21cdde0d65277d388ddd4eca6a155bd0082d764372bb98334a470a290d6231 node-v26.12.1.pkg +717244a8d757672ec86aae5077fca31e50f84b094441ec51bdf397aab12c304e node-v26.12.1.tar.gz +053e3b296859b6d8d93f99ef97fa9cec1c4ee171c72968100c649978c1dbd38c node-v26.12.1.tar.xz +6331496efd27f1839bbc063c2053b57547b74f9119d3add736b1044cf1ffe127 node-v26.12.1-win-arm64.7z +34567581ee63967b37afb6b7a0cc63a2d550a43d5d838adb75982d7e356f2e2c node-v26.12.1-win-arm64.zip +4deef78146a60555c9518438cae38da8df71722ca856920b90078f5cdeb642a6 node-v26.12.1-win-x64.7z +b3efd5c70cba3308ed46e7e699a9b8aac075bbc6b027fcb39c84c31acc25e2b4 node-v26.12.1-win-x64.zip +f32a2844504ed8d73449ddb480385f69cb436bc9409a89e2049ae83447078457 node-v26.12.1-x64.msi +7384299eeb99f419acaa4142771689fbca72e1c942f8da02b7928ffe1744e3ff win-arm64/node.exe +45084cbfc0170d7a30b29ab1eeeb2b0d770995ade0a13a4cc82cf31189f95c9f win-arm64/node.lib +6d8218cbb766e0432c9a3b12354ce20cbaa78e336503a4ef849135498afa4a30 win-arm64/node_pdb.7z +f5dd209b8f6e06de4d29039e9e6be982826cd048f6a287931887aee3beb691de win-arm64/node_pdb.zip +1c63f1417e2e26d83ca9a9ec1d548524ab1305bc7209d90ebca56257ff0d84ed win-x64/node.exe +caad0090dc3add94c06abd01e395e8ec0f1586c10071bda1f99480445d695f6f win-x64/node.lib +8fa448e677de8d35b6af7176eac6fe9e696e10ceaa159118584c424f5908d56c win-x64/node_pdb.7z +495a8ab1fb56825b56f0b8057880e0593fbd9ee6b05bc2c659ec748fd7584e0d win-x64/node_pdb.zip + +-----BEGIN PGP SIGNATURE----- + +iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCatiV6QAKCRAgsaOQsWjT +VnQpAQC7I47yflrsiP/Y+XrwnsmVDGA3FMDwtXmIc7YvH8uNQQEAoezaai4POcSt +C45Cc7vXI60y686idM8xSCHjTji7nww= +=EzFC +-----END PGP SIGNATURE----- +``` From b56b173c24619207465667c00c4f50f4bf826f2b Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 21 Oct 2026 13:23:42 +0200 Subject: [PATCH 2/2] Apply batched suggestions from code review Co-authored-by: Antoine du Hamel Signed-off-by: Antoine du Hamel --- apps/site/pages/en/blog/release/v26.12.1.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/apps/site/pages/en/blog/release/v26.12.1.md b/apps/site/pages/en/blog/release/v26.12.1.md index bea749aac8474..283c82ae02200 100644 --- a/apps/site/pages/en/blog/release/v26.12.1.md +++ b/apps/site/pages/en/blog/release/v26.12.1.md @@ -15,12 +15,10 @@ This is a security release. - (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High - (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High - (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High -- (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) – High - (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High - (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium - (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium - (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low -- (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low - (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low - deps: V8: backport 93cd21e8254b (Joyee Cheung) - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)