Skip to content

Commit 012ecf5

Browse files
RafaelGSSRafaelGSS
committed
2026-07-29, Version 24.18.1 'Krypton' (LTS)
This is a security release. Notable changes: * (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 7.29.0 (Node.js GitHub Bot) PR-URL: nodejs-private/node-private#937 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
1 parent f8f8aa2 commit 012ecf5

2 files changed

Lines changed: 41 additions & 1 deletion

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ release.
5151
<a href="doc/changelogs/CHANGELOG_V26.md#26.0.0">26.0.0</a><br/>
5252
</td>
5353
<td valign="top">
54-
<b><a href="doc/changelogs/CHANGELOG_V24.md#24.18.0">24.18.0</a></b><br/>
54+
<b><a href="doc/changelogs/CHANGELOG_V24.md#24.18.1">24.18.1</a></b><br/>
55+
<a href="doc/changelogs/CHANGELOG_V24.md#24.18.0">24.18.0</a><br/>
5556
<a href="doc/changelogs/CHANGELOG_V24.md#24.17.0">24.17.0</a><br/>
5657
<a href="doc/changelogs/CHANGELOG_V24.md#24.16.0">24.16.0</a><br/>
5758
<a href="doc/changelogs/CHANGELOG_V24.md#24.15.0">24.15.0</a><br/>

‎doc/changelogs/CHANGELOG_V24.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
</tr>
1010
<tr>
1111
<td>
12+
<a href="#24.18.1">24.18.1</a><br/>
1213
<a href="#24.18.0">24.18.0</a><br/>
1314
<a href="#24.17.0">24.17.0</a><br/>
1415
<a href="#24.16.0">24.16.0</a><br/>
@@ -68,6 +69,44 @@
6869
* [io.js](CHANGELOG_IOJS.md)
6970
* [Archive](CHANGELOG_ARCHIVE.md)
7071

72+
<a id="24.18.1"></a>
73+
74+
## 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol
75+
76+
This is a security release.
77+
78+
### Notable Changes
79+
80+
* (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
81+
* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
82+
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
83+
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
84+
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
85+
* (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
86+
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
87+
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
88+
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
89+
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
90+
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
91+
* deps: update llhttp to 9.4.3 (Paolo Insogna)
92+
* deps: update undici to 7.29.0 (Node.js GitHub Bot)
93+
94+
### Commits
95+
96+
* \[[`6cb0475751`](https://github.com/nodejs/node/commit/6cb0475751)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
97+
* \[[`bcfe21d3dc`](https://github.com/nodejs/node/commit/bcfe21d3dc)] - **deps**: update undici to 7.29.0 (Node.js GitHub Bot) [#64713](https://github.com/nodejs/node/pull/64713)
98+
* \[[`9d0d36cffd`](https://github.com/nodejs/node/commit/9d0d36cffd)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
99+
* \[[`8a008fb523`](https://github.com/nodejs/node/commit/8a008fb523)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
100+
* \[[`a77c7f7354`](https://github.com/nodejs/node/commit/a77c7f7354)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
101+
* \[[`34ed88a069`](https://github.com/nodejs/node/commit/34ed88a069)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#63752](https://github.com/nodejs/node/pull/63752)
102+
* \[[`95ba2cfde7`](https://github.com/nodejs/node/commit/95ba2cfde7)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904)
103+
* \[[`fcbdbe47ea`](https://github.com/nodejs/node/commit/fcbdbe47ea)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
104+
* \[[`ea26c12b56`](https://github.com/nodejs/node/commit/ea26c12b56)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
105+
* \[[`9a6b7e343a`](https://github.com/nodejs/node/commit/9a6b7e343a)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926)
106+
* \[[`6c0c990880`](https://github.com/nodejs/node/commit/6c0c990880)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927)
107+
* \[[`af9ff0490c`](https://github.com/nodejs/node/commit/af9ff0490c)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896)
108+
* \[[`05f541b5c0`](https://github.com/nodejs/node/commit/05f541b5c0)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)
109+
71110
<a id="24.18.0"></a>
72111

73112
## 2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxa

0 commit comments

Comments
 (0)