(CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
(CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
(CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
(CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
(CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
(CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
(CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
(CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
(CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
(CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
(CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
(CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
(CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
(CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
(CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
(CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
(CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
(CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
deps: update brotli to 1.2.1 (Node.js GitHub Bot)
deps: update llhttp to 9.4.4 (Antoine du Hamel)
deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
deps: update undici to 7.30.2 (Node.js GitHub Bot)
[ 4c12b8a775 ] - build : respect OpenSSL's configured API level (Filip Skokan) #66953
[ 5654932a7d ] - crypto : fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
[ e88009c61c ] - deps : brotli: cherry-pick e230f474b87 (liujiahui) #61003
[ 92e8d82e0e ] - deps : update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
[ 4164b5c2b4 ] - deps : update brotli to 1.2.1 (Node.js GitHub Bot) #66990
[ 4fec855b1d ] - deps : update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
[ 17c9eb75f3 ] - deps : update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
[ 57ebbdc275 ] - deps : update undici to 7.30.2 (Node.js GitHub Bot) #67273
[ 8749030ae5 ] - http : redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
[ 8e100ac90a ] - http2 : retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
[ 03f040685b ] - http2 : charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
[ 7be19aa614 ] - http2 : retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
[ ff8938913b ] - http2 : release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
[ ae9ab37d62 ] - http2 : avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
[ a081fd3a3e ] - http2 : detect streams abandoned by nghttp2 (Matteo Collina) #66641
[ 22f4367981 ] - http2 : guard against null write request on cancelled stream (Matteo Collina) #67252
[ 4f60230182 ] - https : isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
[ fdbc6ab7ac ] - permission : do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
[ d13a284de6 ] - src : fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
[ c3485f2417 ] - tls : fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
[ 599ca08e28 ] - tls : disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
[ 981d2defc6 ] - tls : don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
[ 799abe55cb ] - tls : don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
[ 45e3b1637a ] - tls : apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
[ 25d487e3da ] - tls,http : prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
[ e14e27b8d3 ] - zlib : handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037
Windows 64-bit Installer: Windows ARM 64-bit Installer: Windows 64-bit Binary: Windows ARM 64-bit Binary: macOS 64-bit Installer: macOS Apple Silicon 64-bit Binary: macOS Intel 64-bit Binary: Linux 64-bit Binary: Linux PPC LE 64-bit Binary: Linux s390x 64-bit Binary: AIX 64-bit Binary: ARMv8 64-bit Binary: Source Code: Other release files: Documentation:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
