Antoine du Hamel
2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95
This is a security release.
Notable Changes
- (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- deps: update timezone to 2026e (Node.js GitHub Bot)
- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
- deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
- deps: update undici to 6.29.1 (Node.js GitHub Bot)
Commits
- [
68fa0df6d6
] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 - [
dd6b47573b
] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 - [
a62b7d5362
] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966 - [
ec9e5e4a3e
] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 - [
a538a9515d
] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 - [
67d294739f
] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 - [
1ab9db8a74
] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419 - [
52b4bcab03
] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333 - [
60f4833d41
] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 - [
05470dc308
] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 - [
47333fe4f4
] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745 - [
98258b855f
] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180 - [
a8349b6408
] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774 - [
e9e295bcc1
] - deps: cherry-pick e807d4e379 from SQLite (Junsu Han) #63525 - [
512a9b61f0
] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217 - [
e708247254
] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699 - [
857be5afa3
] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #66765 - [
19c5056002
] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 - [
e7b2985d59
] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 - [
50ab804edc
] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 - [
a18ec92752
] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH
(Antoine du Hamel) nodejs-private/node-private#1002 - [
4342503fd8
] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871 - [
d7663560ac
] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 - [
beb4cd4cd3
] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145 - [
4b42e56aaf
] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
Windows 32-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-x86.msi
Windows 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-x64.msi
Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-arm64.msi
Windows 32-bit Binary: https://nodejs.org/dist/v22.23.4/win-x86/node.exe
Windows 64-bit Binary: https://nodejs.org/dist/v22.23.4/win-x64/node.exe
Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.23.4/win-arm64/node.exe
macOS 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4.pkg
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-darwin-arm64.tar.gz
macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-darwin-x64.tar.gz
Linux 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-x64.tar.xz
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-ppc64le.tar.xz
Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-s390x.tar.xz
AIX 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-aix-ppc64.tar.gz
ARMv7 32-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-armv7l.tar.xz
ARMv8 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-arm64.tar.xz
Source Code: https://nodejs.org/dist/v22.23.4/node-v22.23.4.tar.gz
Other release files: https://nodejs.org/dist/v22.23.4/
Documentation: https://nodejs.org/docs/v22.23.4/api/
SHASUMS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
c219410bea0aed08ecfa5847a3d8aca4e45dd494a094f86c0d8721138360a9c9 node-v22.23.4-aix-ppc64.tar.gz
49edbb15812c13efa061c2c76b06944425f3711454845e78b625a8e865a45327 node-v22.23.4-arm64.msi
c9e1dbc748b33ed2d14f42445191ecaf14c56259c7a9a26d0042c49ec2b66428 node-v22.23.4-darwin-arm64.tar.gz
037650d0839f457747396f052073fb48333d31bf5abd3c98b74da20d89ebb1ad node-v22.23.4-darwin-arm64.tar.xz
efcc2b0db6f94bf53eddb038fe2b370277a042bd29e4f19b8f8e23598795b819 node-v22.23.4-darwin-x64.tar.gz
f42abca7aaac61efc57d49fb42ea84fc53bbeba9a749cb03a291ce6e4e7a69c1 node-v22.23.4-darwin-x64.tar.xz
dc4028dc105e27e5295119dd9da076fca71d5216113e097813f0fb30f59241a5 node-v22.23.4-headers.tar.gz
00615892b14ca159775ccb96d5696fdfeeea9804740fc8c5c1064eac09456a0e node-v22.23.4-headers.tar.xz
f7a1e486dbc8b286847815b477d4fb5e9fb963ed4489c3e1588853d685f589f9 node-v22.23.4-linux-arm64.tar.gz
6287aa46b6c375d816e63ae66d024fbbfd70404825aabdfdf898a970871d2f4b node-v22.23.4-linux-arm64.tar.xz
4318e0c68f62e18583dae85eb645f55c7f2b8a2e8d1fffe91a2e8abd046880ab node-v22.23.4-linux-armv7l.tar.gz
c9057c6a3b8fbb9651ed115c1e96d4a7281b7b9c9ca89fa05865c98ed7ffd437 node-v22.23.4-linux-armv7l.tar.xz
6684903ee2795aafe639dc07203e8a51ed20ae161cf21b6da7c213c8abfed442 node-v22.23.4-linux-ppc64le.tar.gz
e4732f45e0cad787d6ba70c4eb6db45dbdb3f286f67dee429dbc6b4ff36eac43 node-v22.23.4-linux-ppc64le.tar.xz
0bdc80fa27331e7f416d1d8553b9aabbc3c158709dc32859e4e85724ac1ac302 node-v22.23.4-linux-s390x.tar.gz
07ae074fc218fc42e24c939df0dc0209443fb08eb5b2ed6d26b1bf6757781fff node-v22.23.4-linux-s390x.tar.xz
63189402eaa222aabf51b4983e512592131cd2d4a9efc3ad9bf291fe74e3e4de node-v22.23.4-linux-x64-musl.tar.gz
38355b952f0392b91703d38a0d9af84eb0ff77d69828ca4bc8cc3bc3af80a720 node-v22.23.4-linux-x64-musl.tar.xz
b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406 node-v22.23.4-linux-x64.tar.gz
1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce node-v22.23.4-linux-x64.tar.xz
2095e4e478f01cfc1cd3784482bbb5bc67feab9bb21336b8934718bfc0f3b435 node-v22.23.4.pkg
4dd79de8cdc85d65cb32f48a75aee1067bf00bf94b96ecc8e4c2f82f6f0272c2 node-v22.23.4.tar.gz
7b9adc82d612d0a2a863d96c46de2292552e250cee51956ebbe0146c42aacae9 node-v22.23.4.tar.xz
a31b4be40d29f457dcd818563f2a3cf77f1ca35a15d3477cab38b3cc6d3a426a node-v22.23.4-win-arm64.7z
a8b8cd79cbbb3062435f449591d98dd63730bbbf30ce2d7cc3a6376c236cb111 node-v22.23.4-win-arm64.zip
010e51ccdd453d747ca67bfe8dda2c5da82540fa896ce2527f286d549574f975 node-v22.23.4-win-x64.7z
cbc74b5e0982c9dbb41525fd8fb5dcd32fbee237863f7829072f4639a1ce5f20 node-v22.23.4-win-x64.zip
b393001b81f7d478863394692bb57d28c0afe399fabbab3bce6016bb1cfa181f node-v22.23.4-win-x86.7z
7d6c4dce2ecccca46e3c4b3e43c8bebbd1969bd616fdb4fda1e8269171d9ccea node-v22.23.4-win-x86.zip
ca9303d3a12e8bec6de829fcb7812fc776930e0ce5c030328a24984ef928427e node-v22.23.4-x64.msi
c2a76d76eda52b7930b51fd490264c2fe34a094c04ae721bb71893f3fd6cd1d0 node-v22.23.4-x86.msi
64d9f6e69b4703870e8cd30a3477127df8b683ea04feb03660e439396549042a win-arm64/node.exe
5378f5bad777b4929d1cd4f58974e0ef03815ce5c159863f1875c4b434460c27 win-arm64/node.lib
8ad8a3ad402d8cf3bc760bf8ad03c85996ae6676a93407b6f06320ef5e981387 win-arm64/node_pdb.7z
4f94c9c8ab6a3ca4003e41ae226f191cb9ae837312d1390c14db94771a5abc94 win-arm64/node_pdb.zip
dccc52de28d8df2ee22d2062424f8c563070d95d8ad70c54c4bf01d590dec14f win-x64/node.exe
c243185f2347870cadb637c909bf123fc703dc65dbfa769b17ec45a4b661d782 win-x64/node.lib
c8496e103ee832fb8daf21af22b418c88558956457b9d850e95f78baf7f779cd win-x64/node_pdb.7z
426d3e46b15a918c561a15c2c99610d8edac752a406cf0b573809add0ff96f5d win-x64/node_pdb.zip
aa39a7741f62832ea50daba0113c8f8b12ccde226abca931326832d5bc47d31f win-x86/node.exe
eff47cc18fe2d3e40886cd49f04a85134681657d8b0f2afc55f363743cf6ddd7 win-x86/node.lib
2f5fcf07c631cff056ba53d4d8fb71d33d6302e243b7b267bfe3e226a3d76193 win-x86/node_pdb.7z
8aff266913d43a87103ebe02a4631148491b987ac2f70c6f3c95cf7e160de264 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCatiU6AAKCRAgsaOQsWjT
VnXQAQDr+PrTYZtsgzxkf4LjsVlHCaVc9S8q5J1wHIcaNniLrwD/SCaZV98GQixc
dMdWJU0vUeZgB8Szb/eD1b3hcZmG3AY=
=vuXb
-----END PGP SIGNATURE-----