What’s New

Node.js v26.5.1

v26.5.1

2026-07-29, Version 26.5.1 (Current), @RafaelGSS

Changed
  • Update llhttp to 9.4.3
  • Update undici to 8.9.0
Security
  • Defer rst stream while in scope in http2 module (CVE-2026-56848)
  • Avoid granting radix split nodes in permission module (CVE-2026-58043)
  • Distinguish PFX object-array agent keys in https module (CVE-2026-56850)
  • Bind identity checks to session reuse in https module (CVE-2026-58040)
  • Invalidate tag store iterators on statement reset in sqlite module (CVE-2026-58041)
  • Handle large resolveAny address replies in dns module (CVE-2026-58042)
  • Throw on out-of-bounds write buffers in zlib module (CVE-2026-58045)
  • Enforce fs write permission for trace events in permission module (CVE-2026-56847)
  • Check final report output path in permission module (CVE-2026-58039)
  • Reject requests exceeding max header count in http module (CVE-2026-58044)

This is a security release.

Notable Changes
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 8.9.0 (Node.js GitHub Bot)
Commits
View original