● Covered by 1 source · 3 reportsMedium impact3 neutral
Node.js Releases Security Updates for Versions 22.23.2, 24.18.1, and 26.5.1
Key points
- Node.js released security updates for versions 22.23.2, 24.18.1, and 26.5.1.
- Updates address high-severity vulnerabilities in http2 and permission handling.
- Multiple medium and low-severity issues were also patched.
- Dependencies llhttp and undici were updated in all releases.
- The updates are crucial for application security and stability.
Node.js Security Releases
Node.js has issued security updates across three of its active release lines: 22.23.2 (LTS), 24.18.1 (LTS), and 26.5.1 (Current). These releases are primarily focused on addressing security vulnerabilities identified within the platform.
High-Severity Vulnerabilities Addressed
All three updates patch high-severity vulnerabilities. These include issues related to http2, specifically CVE-2026-56848 ("http2: defer rst stream while in scope") and CVE-2026-56846 ("http2: retain header memory in session accounting"), which affects versions 22.23.2 and 24.18.1. A high-severity permission vulnerability, CVE-2026-58043 ("permission: avoid granting radix split nodes"), is also resolved across all updated versions.
Medium and Low Severity Fixes
In addition to high-severity issues, the releases address several medium and low-severity vulnerabilities. Medium-severity fixes include CVE-2026-56850 ("https: distinguish PFX object-array agent keys"), CVE-2026-58040 ("https: bind identity checks to session reuse"), CVE-2026-58042 ("dns: handle large resolveAny address replies"), and CVE-2026-58045 ("zlib: throw on out-of-bounds write buffers"). Version 24.18.1 and 26.5.1 also include a fix for CVE-2026-58041 ("sqlite: invalidate tag store iterators on statement reset"). Low-severity issues include CVE-2026-56847, CVE-2026-58039, and CVE-2026-58044.
Dependency Updates
Each security release also includes updates to key dependencies. The `llhttp` dependency has been updated to version 9.4.3 across all three Node.js versions. The `undici` dependency has been updated to 6.28.0 in Node.js 22.23.2, to 7.29.0 in Node.js 24.18.1, and to 8.9.0 in Node.js 26.5.1.
Importance for Developers
These updates are crucial for developers and organizations using Node.js, as they mitigate potential security risks that could impact application stability and data integrity. Users are advised to update their Node.js installations to the latest patched versions to ensure continued security.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub nodejs/node GitHub nodejs-private/node-private GitHub nodejs/nodejs.org CVE CVE-2026-568467.5 HIGH CVE CVE-2026-568487.5 HIGH CVE CVE-2026-580437.5 HIGHHow outlets covered it
Node.js has released version 24.18.1, a Long Term Support (LTS) security update addressing several vulnerabilities, including high-severity issues in http2 and permission handling. This update is critical for maintaining the security and stability of applications built on Node.js, as it patches potential exploits that could impact data integrity and system access.
Node.js 26.5.1 has been released as a security update, addressing several vulnerabilities including two high-severity issues related to http2 and permission handling. This update is important for users to maintain the security and stability of their Node.js applications.
Node.js has released version 22.23.2, a Long Term Support (LTS) update that addresses several security vulnerabilities. This update is important for maintaining the security and stability of applications built on Node.js, as it patches high and medium severity issues.