What’s New

Node.js v22.23.2

v22.23.2

2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolito

Changed
  • update llhttp to 9.4.3
  • update undici to 6.28.0
Security
  • http2: retain header memory in session accounting
  • http2: defer rst stream while in scope
  • permission: avoid granting radix split nodes
  • https: distinguish PFX object-array agent keys
  • https: bind identity checks to session reuse
  • dns: handle large resolveAny address replies
  • zlib: throw on out-of-bounds write buffers
  • permission: enforce fs write permission for trace events
  • permission: check final report output path
  • http: reject requests exceeding max header count

This is a security release.

Notable Changes
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 6.28.0 (Node.js GitHub Bot)
Commits
View original