(CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
(CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
(CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
(CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
(CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
(CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
(CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
(CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
(CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
(CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
(CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
(CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
(CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
(CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
(CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
(CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
(CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
(CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
deps: update brotli to 1.2.1 (Node.js GitHub Bot)
deps: update llhttp to 9.4.4 (Antoine du Hamel)
deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
deps: update undici to 8.12.4 (Node.js GitHub Bot)
[ 7b777661f5 ] - build : respect OpenSSL's configured API level (Filip Skokan) #66953
[ 4518c7501f ] - crypto : fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
[ 94b73673b8 ] - deps : brotli: cherry-pick e230f474b87 (liujiahui) #61003
[ e315236158 ] - deps : update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
[ 8e714f7daa ] - deps : update undici to 8.12.4 (Node.js GitHub Bot) #67272
[ af48b1a4d5 ] - deps : update brotli to 1.2.1 (Node.js GitHub Bot) #66990
[ 60316405bb ] - deps : update undici to 8.12.3 (Node.js GitHub Bot) #66993
[ 89b17baef4 ] - deps : update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
[ d14db811c7 ] - http : redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
[ 9183db64fe ] - http2 : retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
[ 62ae278a23 ] - http2 : charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
[ 7df134e2ce ] - http2 : retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
[ 0ff0cf6749 ] - http2 : release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
[ a84a01ddb8 ] - http2 : avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
[ 3fc67dc056 ] - http2 : detect streams abandoned by nghttp2 (Matteo Collina) #66641
[ df4011dafe ] - http2 : guard against null write request on cancelled stream (Matteo Collina) #67252
[ fa61009dc1 ] - https : isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
[ 40d3d8ddca ] - permission : do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
[ 6c85b8e371 ] - tls : fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
[ a8d6286949 ] - tls : disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
[ e750e1fa02 ] - tls : don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
[ 97b1357f08 ] - tls : don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
[ 66e72ec604 ] - tls : apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
[ 940cae5c33 ] - tls,http : prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
[ 8232390dd8 ] - tools : use vendored trust store in shell.nix (Antoine du Hamel) #67318
[ 6c223db6e2 ] - zlib : handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037
Windows 64-bit Installer: Windows ARM 64-bit Installer: Windows 64-bit Binary: Windows ARM 64-bit Binary: macOS 64-bit Installer: macOS Apple Silicon 64-bit Binary: macOS Intel 64-bit Binary: Linux 64-bit Binary: Linux PPC LE 64-bit Binary: Linux s390x 64-bit Binary: AIX 64-bit Binary: ARMv8 64-bit Binary: Source Code: Other release files: Documentation:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
