(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
deps: update timezone to 2026e (Node.js GitHub Bot)
deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
deps: update undici to 6.29.1 (Node.js GitHub Bot)
[ 68fa0df6d6 ] - crypto : update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
[ dd6b47573b ] - crypto : reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
[ a62b7d5362 ] - crypto : harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
[ ec9e5e4a3e ] - crypto : update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
[ a538a9515d ] - deps : update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
[ 67d294739f ] - deps : brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
[ 1ab9db8a74 ] - deps : update timezone to 2026e (Node.js GitHub Bot) #66419
[ 52b4bcab03 ] - deps : update timezone to 2026d (Node.js GitHub Bot) #66333
[ 60f4833d41 ] - deps : update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
[ 05470dc308 ] - deps : upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
[ 47333fe4f4 ] - deps : update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
[ 98258b855f ] - deps : update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
[ a8349b6408 ] - deps : update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
[ e9e295bcc1 ] - deps : cherry-pick e807d4e379 from SQLite (Junsu Han) #63525
[ 512a9b61f0 ] - deps : update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
[ e708247254 ] - deps : update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
[ 857be5afa3 ] - deps : update undici to 6.29.1 (Node.js GitHub Bot) #66765
[ 19c5056002 ] - dns : validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
[ e7b2985d59 ] - http : ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
[ 50ab804edc ] - permission : check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
[ a18ec92752 ] - src : expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
[ 4342503fd8 ] - tls : reject chains containing blocked public keys (Ulises Gascon) #66871
[ d7663560ac ] - tls : reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
[ beb4cd4cd3 ] - tls : match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
[ 4b42e56aaf ] - tools : retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
Windows 32-bit Installer: Windows 64-bit Installer: Windows ARM 64-bit Installer: Windows 32-bit Binary: Windows 64-bit Binary: Windows ARM 64-bit Binary: macOS 64-bit Installer: macOS Apple Silicon 64-bit Binary: macOS Intel 64-bit Binary: Linux 64-bit Binary: Linux PPC LE 64-bit Binary: Linux s390x 64-bit Binary: AIX 64-bit Binary: ARMv7 32-bit Binary: ARMv8 64-bit Binary: Source Code: Other release files: Documentation:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
