Node.js 22.23.5 (LTS)

Node.js 22.23.5 (LTS)

Antoine du Hamel

2026-11-11, Version 22.23.5 'Jod' (LTS), @aduh95

This is a security release.

Notable Changes

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High

• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High

• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High

• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High

• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High

• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High

• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High

• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High

• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium

• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium

• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium

• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium

• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium

• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium

• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low

• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low

• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low

• deps: update llhttp to 9.4.4 (Antoine du Hamel)

• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)

Commits

• [554fff40f0] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038

• [6577cbf231] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816

• [61d93c6086] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663

• [cd18f6bdff] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001

• [6cd7e80d68] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017

• [9bce421783] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026

• [30fd852c0d] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641

• [21fb5d0348] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252

• [af6fbb6564] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036

• [5c9eed3b1e] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967

• [5e497aec89] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986

• [06af164d09] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030

• [209c7e4d83] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030

• [05e452f075] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030

• [67da864a89] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020

• [c841c6c7f1] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021

• [ea159e84dd] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

Windows 32-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-x86.msi Windows 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-x64.msi Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5-arm64.msi Windows 32-bit Binary: https://nodejs.org/dist/v22.23.5/win-x86/node.exe Windows 64-bit Binary: https://nodejs.org/dist/v22.23.5/win-x64/node.exe Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.23.5/win-arm64/node.exe macOS 64-bit Installer: https://nodejs.org/dist/v22.23.5/node-v22.23.5.pkg macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-darwin-arm64.tar.gz macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-darwin-x64.tar.gz Linux 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-x64.tar.xz Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-ppc64le.tar.xz Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-s390x.tar.xz AIX 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-aix-ppc64.tar.gz ARMv7 32-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-armv7l.tar.xz ARMv8 64-bit Binary: https://nodejs.org/dist/v22.23.5/node-v22.23.5-linux-arm64.tar.xz Source Code: https://nodejs.org/dist/v22.23.5/node-v22.23.5.tar.gz Other release files: https://nodejs.org/dist/v22.23.5/ Documentation: https://nodejs.org/docs/v22.23.5/api/

SHASUMS

        -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

f0dda0bae79678ab6eb3ca02179f4fe534463ce6f68ab942d2b49b057e478433  node-v22.23.5-aix-ppc64.tar.gz
e01778455a929fa3b88ba102cca9527a9b39ca1c9fad1426c216e5e6d81b1a5a  node-v22.23.5-arm64.msi
e7131995759b61a0170b646010d2ad35a5d37b4cb0d471f3e8317eac6f742f3d  node-v22.23.5-darwin-arm64.tar.gz
d0c68c321161bb2c6483efea9a343010dea8e5e7f60d73c6a7eba140016d662f  node-v22.23.5-darwin-arm64.tar.xz
c53383238206b9ae4db23c5d8a63645e2e753bec8ab51a49cc81939aa64e9422  node-v22.23.5-darwin-x64.tar.gz
d68bf234a07781141dfca61ae4461c24560f70bd53223d76a41529eb02e8554e  node-v22.23.5-darwin-x64.tar.xz
be890e343a72acd49e3b0491aefdc55400ed8a8fa29272d2d1ad19823e80035f  node-v22.23.5-headers.tar.gz
ca152fdc8599c56eb2d1c44c58f5abf6dc97a69cddf94edcface9f727f608e1d  node-v22.23.5-headers.tar.xz
8bd3dc69eee8f3f226315a80d7d1d4faccf217a4c8fae500168ac2e38f3bdba3  node-v22.23.5-linux-arm64.tar.gz
2babb9eb5264860d540849f4b064a6fbdebcdc323657d9d382ce23d313fd5e09  node-v22.23.5-linux-arm64.tar.xz
02cd221808721481ba3edd8b51624a391b45357543b8144e6ff7aac35e1500ac  node-v22.23.5-linux-armv7l.tar.gz
1c3e15d38e4cafbbf74377ac070cd9d7e0418c673e1f6332f38f1d4762a699f9  node-v22.23.5-linux-armv7l.tar.xz
de46a027eeb3942d589da63f2c5734e73d5c53aac8245e75088a1ac13bda2e04  node-v22.23.5-linux-ppc64le.tar.gz
578bc696ade54f85439f6fdd5bd7695c2dea40d307565f573b9ea6ad7b1e5615  node-v22.23.5-linux-ppc64le.tar.xz
50f8e113bf6638bb9d5ae6620883fd90b98e8e1f7af10ef87cca9dc979cdb39b  node-v22.23.5-linux-s390x.tar.gz
210232af4b947a70880b985207cb307a8fb310b62c1925bdd971b0eaab96bde0  node-v22.23.5-linux-s390x.tar.xz
83b8ba916eb22e89ba8274426a40f7aa0011c6e4c5ff77a5b03793f781a90786  node-v22.23.5-linux-x64-musl.tar.gz
aef6690916d4b4210b55618ea0beeb927d67184257879b1ebec6e309285f3c08  node-v22.23.5-linux-x64-musl.tar.xz
c54118104acc524633b5abe106bbf44a53126ec8b4e5fa105cb92b5d7de8a1a1  node-v22.23.5-linux-x64.tar.gz
cdeb8670a0c81f51b4dc4ac61919f9b1ad917b304bf8221eb939570663d240f8  node-v22.23.5-linux-x64.tar.xz
89fadefd7798158d8990ca9ed7dbb58f8ca7593adb92fe3da8a445db99415533  node-v22.23.5.pkg
5ae198a2ec0513ea8b7ef28f71094c9a7931a44e4db17b1734d76fe958e0ff36  node-v22.23.5.tar.gz
6cce7c58bf058700c643944903d60a325e8c9ceede1f5c2c088b435f2ada091a  node-v22.23.5.tar.xz
f863a9fc7bd478d00aac4020cf9a75d81dba59ae078cc30c39bb0792a497cd96  node-v22.23.5-win-arm64.7z
c1856817f611738c77534efbff8a5a17990593eab24046bc8d2c23a77a160d13  node-v22.23.5-win-arm64.zip
aac7072c663c5efa2147aa7d51022d56efb1aa75c7dd0a3e7582501c692a045a  node-v22.23.5-win-x64.7z
4a191082e9706866830379d577d2cc8a50c776fcd9436a8d061b063ed0d9a0e3  node-v22.23.5-win-x64.zip
423dd2a38fbf7df6142242e7a10ee845389efe114577c47f359a28066deea2b5  node-v22.23.5-win-x86.7z
9c01245683c87e3f81eedfbad82c1665611749627cd1b0b5a42921db9361b4a6  node-v22.23.5-win-x86.zip
963a110509eca7e0d6cc009095ccb4117e26d59287876a056b79293ae3fef238  node-v22.23.5-x64.msi
0118588f943cd620c66a688edca3d33231feeae2d0ae391cff0ef00e44d522e2  node-v22.23.5-x86.msi
c2eaa48231229b966bfef21554df203221862a9fc94ec2a6908aad5eaa6c0ba0  win-arm64/node.exe
5378f5bad777b4929d1cd4f58974e0ef03815ce5c159863f1875c4b434460c27  win-arm64/node.lib
974f58f3978b9302a5f842979694c27ab3a544cc3e52bd9ab8e9ba0429be5aef  win-arm64/node_pdb.7z
cbff923c9d6397394e119fb05437f28b31efdb90afcb519a655f987430a983f7  win-arm64/node_pdb.zip
247e9693d316da9857e44990e5e11709f596f18112251b8026ec6eed80bdf38a  win-x64/node.exe
c243185f2347870cadb637c909bf123fc703dc65dbfa769b17ec45a4b661d782  win-x64/node.lib
03dabf86832838fbcb92816c11ee5fd59864c79573931177654b27dc7c4092ff  win-x64/node_pdb.7z
82dd773a53ce2aaacaf41014ee81caa82e5bc2ed2b8e72f4764201c662b52995  win-x64/node_pdb.zip
a6f12cfaa84f16d1cfb36ccca361e155acee9e8a4e47fdc3a684cda361ad245a  win-x86/node.exe
eff47cc18fe2d3e40886cd49f04a85134681657d8b0f2afc55f363743cf6ddd7  win-x86/node.lib
21a4e0bea77234963c96e14e01d147be604b320ee692c6927aff61f59418e59c  win-x86/node_pdb.7z
0e417cff977767812ff81c98f420a514f83193e7ca799bcb1cff99a659a0b983  win-x86/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCavSZnAAKCRAgsaOQsWjT
Vj01APwPC7+mOBYsepjXXr42B+d4UiWxpfUlX9PplsLbvTLojAD/TxXm1ctPiszb
QS5t+HXqDJrH0/fKcE/e8ZY43hHZyAk=
=W25e
-----END PGP SIGNATURE-----