Skip to content

Commit 27f2131

Browse files
aduh95aduh95
committed
2026-10-21, Version 22.23.4 'Jod' (LTS)
This is a security release. Notable changes: * (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) * (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) * (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina) * (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) * (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) * (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) * (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) * crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) * deps: update c-ares to 1.34.9 (Node.js GitHub Bot) * deps: update timezone to 2026e (Node.js GitHub Bot) * deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) * deps: update sqlite to 3.53.4 (Node.js GitHub Bot) * deps: update undici to 6.29.1 (Node.js GitHub Bot) PR-URL: nodejs-private/node-private#1010
1 parent 4342503 commit 27f2131

3 files changed

Lines changed: 54 additions & 2 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ release.
3737
</tr>
3838
<tr>
3939
<td valign="top">
40-
<b><a href="doc/changelogs/CHANGELOG_V22.md#22.23.3">22.23.3</a></b><br/>
40+
<b><a href="doc/changelogs/CHANGELOG_V22.md#22.23.4">22.23.4</a></b><br/>
41+
<a href="doc/changelogs/CHANGELOG_V22.md#22.23.3">22.23.3</a><br/>
4142
<a href="doc/changelogs/CHANGELOG_V22.md#22.23.2">22.23.2</a><br/>
4243
<a href="doc/changelogs/CHANGELOG_V22.md#22.23.1">22.23.1</a><br/>
4344
<a href="doc/changelogs/CHANGELOG_V22.md#22.23.0">22.23.0</a><br/>

‎doc/changelogs/CHANGELOG_V22.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
</tr>
1010
<tr>
1111
<td>
12+
<a href="#22.23.4">22.23.4</a><br/>
1213
<a href="#22.23.3">22.23.3</a><br/>
1314
<a href="#22.23.2">22.23.2</a><br/>
1415
<a href="#22.23.1">22.23.1</a><br/>
@@ -75,6 +76,56 @@
7576
* [io.js](CHANGELOG_IOJS.md)
7677
* [Archive](CHANGELOG_ARCHIVE.md)
7778

79+
<a id="22.23.4"></a>
80+
81+
## 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95
82+
83+
This is a security release.
84+
85+
### Notable Changes
86+
87+
* (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
88+
* (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
89+
* (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
90+
* (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
91+
* (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
92+
* (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel)
93+
* (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
94+
* crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
95+
* deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
96+
* deps: update timezone to 2026e (Node.js GitHub Bot)
97+
* deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
98+
* deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
99+
* deps: update undici to 6.29.1 (Node.js GitHub Bot)
100+
101+
### Commits
102+
103+
* \[[`68fa0df6d6`](https://github.com/nodejs/node/commit/68fa0df6d6)] - **crypto**: update root certificates to NSS 3.131.1 (Antoine du Hamel) [#66877](https://github.com/nodejs/node/pull/66877)
104+
* \[[`dd6b47573b`](https://github.com/nodejs/node/commit/dd6b47573b)] - **crypto**: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-private/node-private/pull/987)
105+
* \[[`a62b7d5362`](https://github.com/nodejs/node/commit/a62b7d5362)] - **crypto**: harden X.509 conversion and formatting (Filip Skokan) [nodejs-private/node-private#966](https://github.com/nodejs-private/node-private/pull/966)
106+
* \[[`ec9e5e4a3e`](https://github.com/nodejs/node/commit/ec9e5e4a3e)] - **crypto**: update root certificates to NSS 3.129 (Node.js GitHub Bot) [#66496](https://github.com/nodejs/node/pull/66496)
107+
* \[[`a538a9515d`](https://github.com/nodejs/node/commit/a538a9515d)] - **deps**: update c-ares to 1.34.9 (Node.js GitHub Bot) [#66868](https://github.com/nodejs/node/pull/66868)
108+
* \[[`67d294739f`](https://github.com/nodejs/node/commit/67d294739f)] - **deps**: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002)
109+
* \[[`1ab9db8a74`](https://github.com/nodejs/node/commit/1ab9db8a74)] - **deps**: update timezone to 2026e (Node.js GitHub Bot) [#66419](https://github.com/nodejs/node/pull/66419)
110+
* \[[`52b4bcab03`](https://github.com/nodejs/node/commit/52b4bcab03)] - **deps**: update timezone to 2026d (Node.js GitHub Bot) [#66333](https://github.com/nodejs/node/pull/66333)
111+
* \[[`60f4833d41`](https://github.com/nodejs/node/commit/60f4833d41)] - **deps**: update archs files for openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396)
112+
* \[[`05470dc308`](https://github.com/nodejs/node/commit/05470dc308)] - **deps**: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396)
113+
* \[[`47333fe4f4`](https://github.com/nodejs/node/commit/47333fe4f4)] - **deps**: update sqlite to 3.53.4 (Node.js GitHub Bot) [#64745](https://github.com/nodejs/node/pull/64745)
114+
* \[[`98258b855f`](https://github.com/nodejs/node/commit/98258b855f)] - **deps**: update sqlite to 3.53.3 (Node.js GitHub Bot) [#64180](https://github.com/nodejs/node/pull/64180)
115+
* \[[`a8349b6408`](https://github.com/nodejs/node/commit/a8349b6408)] - **deps**: update sqlite to 3.53.2 (Node.js GitHub Bot) [#63774](https://github.com/nodejs/node/pull/63774)
116+
* \[[`e9e295bcc1`](https://github.com/nodejs/node/commit/e9e295bcc1)] - **deps**: cherry-pick e807d4e379 from SQLite (Junsu Han) [#63525](https://github.com/nodejs/node/pull/63525)
117+
* \[[`512a9b61f0`](https://github.com/nodejs/node/commit/512a9b61f0)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#63217](https://github.com/nodejs/node/pull/63217)
118+
* \[[`e708247254`](https://github.com/nodejs/node/commit/e708247254)] - **deps**: update sqlite to 3.53.0 (Node.js GitHub Bot) [#62699](https://github.com/nodejs/node/pull/62699)
119+
* \[[`857be5afa3`](https://github.com/nodejs/node/commit/857be5afa3)] - **deps**: update undici to 6.29.1 (Node.js GitHub Bot) [#66765](https://github.com/nodejs/node/pull/66765)
120+
* \[[`19c5056002`](https://github.com/nodejs/node/commit/19c5056002)] - **dns**: validate resolve inputs for null bytes (James M Snell) [nodejs-private/node-private#984](https://github.com/nodejs-private/node-private/pull/984)
121+
* \[[`e7b2985d59`](https://github.com/nodejs/node/commit/e7b2985d59)] - **http**: ensure agent data guard works without I/O (James M Snell) [nodejs-private/node-private#983](https://github.com/nodejs-private/node-private/pull/983)
122+
* \[[`50ab804edc`](https://github.com/nodejs/node/commit/50ab804edc)] - **permission**: check permission model in realpathSync (RafaelGSS) [nodejs-private/node-private#973](https://github.com/nodejs-private/node-private/pull/973)
123+
* \[[`a18ec92752`](https://github.com/nodejs/node/commit/a18ec92752)] - **src**: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002)
124+
* \[[`4342503fd8`](https://github.com/nodejs/node/commit/4342503fd8)] - **tls**: reject chains containing blocked public keys (Ulises Gascon) [#66871](https://github.com/nodejs/node/pull/66871)
125+
* \[[`d7663560ac`](https://github.com/nodejs/node/commit/d7663560ac)] - **tls**: reject non-canonical IP addresses (Matteo Collina) [nodejs-private/node-private#982](https://github.com/nodejs-private/node-private/pull/982)
126+
* \[[`beb4cd4cd3`](https://github.com/nodejs/node/commit/beb4cd4cd3)] - **tls**: match IPv6 hosts against IP-Address SANs (Pascal Garber) [#64145](https://github.com/nodejs/node/pull/64145)
127+
* \[[`4b42e56aaf`](https://github.com/nodejs/node/commit/4b42e56aaf)] - **tools**: retry Gatekeeper check and stapling after notarization (Ryan Aslett) [#66855](https://github.com/nodejs/node/pull/66855)
128+
78129
<a id="22.23.3"></a>
79130

80131
## 2026-09-23, Version 22.23.3 'Jod' (LTS), @aduh95 prepared by @juanarbol

‎src/node_version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
#define NODE_VERSION_IS_LTS 1
3030
#define NODE_VERSION_LTS_CODENAME "Jod"
3131

32-
#define NODE_VERSION_IS_RELEASE 0
32+
#define NODE_VERSION_IS_RELEASE 1
3333

3434
#ifndef NODE_STRINGIFY
3535
#define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)

0 commit comments

Comments
 (0)