NODEJS-22.23.4 release notes and known issues

Summary

This is a security release. Notable Changes ( CVE-2026-105481 ) http: ensure agent data guard works without I/O (James M Snell) ( CVE-2026-105482 ) dns: validate resolve inputs for null bytes (James M Snell) ( CVE-2026-106069 ) tls: reject non-canonical IP addresses (Matteo Collina) ( CVE-2026-106073 ) permission: check permission model in realpathSync (RafaelGSS) ( CVE-2026-106074 ) crypto: reset random caches across snapshots (Filip Skokan) ( CVE-2026-111497 ) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) ( CVE-2026-111497 ) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) deps: update c-ares to 1.34.9 (Node.js GitHub Bot) deps: update timezone to 2026e (Node.js GitHub Bot) deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) deps: update sqlite to 3.53.4 (Node.js GitHub Bot) deps: update undici to 6.29.1 (Node.js GitHub Bot) Commits [ 68fa0df6d6 ] - crypto : update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 [ dd6b47573b ] - crypto : reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 [ a62b7d5362 ] - crypto : harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966 [ ec9e5e4a3e ] - crypto : update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 [ a538a9515d ] - deps : update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 [ 67d294739f ] - deps : brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 [ 1ab9db8a74 ] - deps : update timezone to 2026e (Node.js GitHub Bot) #66419 [ 52b4bcab03 ] - deps : update timezone to 2026d (Node.js GitHub Bot) #66333 [ 60f4833d41 ] - deps : update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 05470dc308 ] - deps : upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 47333fe4f4 ] - deps : update sqlite to 3.53.4 (Node.js GitHub Bot) #64745 [ 98258b855f ] - deps : update sqlite to 3.53.3 (Node.js GitHub Bot) #64180 [ a8349b6408 ] - deps : update sqlite to 3.53.2 (Node.js GitHub Bot) #63774 [ e9e295bcc1 ] - deps : cherry-pick e807d4e379 from SQLite (Junsu Han) #63525 [ 512a9b61f0 ] - deps : update sqlite to 3.53.1 (Node.js GitHub Bot) #63217 [ e708247254 ] - deps : update sqlite to 3.53.0 (Node.js GitHub Bot) #62699 [ 857be5afa3 ] - deps : update undici to 6.29.1 (Node.js GitHub Bot) #66765 [ 19c5056002 ] - dns : validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 [ e7b2985d59 ] - http : ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 [ 50ab804edc ] - permission : check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 [ a18ec92752 ] - src : expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002 [ 4342503fd8 ] - tls : reject chains containing blocked public keys (Ulises Gascon) #66871 [ d7663560ac ] - tls : reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 [ beb4cd4cd3 ] - tls : match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145 [ 4b42e56aaf ] - tools : retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

Improvements and security content

• This is a security release. Notable Changes ( CVE-2026-105481 ) http: ensure agent data guard works without I/O (James M Snell) ( CVE-2026-105482 ) dns: validate resolve inputs for null bytes (James M Snell) ( CVE-2026-106069 ) tls: reject non-canonical IP addresses (Matteo Collina) ( CVE-2026-106073 ) permission: check permission model in realpathSync (RafaelGSS) ( CVE-2026-106074 ) crypto: reset random caches across snapshots (Filip Skokan) ( CVE-2026-111497 ) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) ( CVE-2026-111497 ) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) deps: update c-ares to 1.34.9 (Node.js GitHub Bot) deps: update timezone to 2026e (Node.js GitHub Bot) deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) deps: update sqlite to 3.53.4 (Node.js GitHub Bot) deps: update undici to 6.29.1 (Node.js GitHub Bot) Commits [ 68fa0df6d6 ] - crypto : update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 [ dd6b47573b ] - crypto : reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 [ a62b7d5362 ] - crypto : harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966 [ ec9e5e4a3e ] - crypto : update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 [ a538a9515d ] - deps : update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 [ 67d294739f ] - deps : brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 [ 1ab9db8a74 ] - deps : update timezone to 2026e (Node.js GitHub Bot) #66419 [ 52b4bcab03 ] - deps : update timezone to 2026d (Node.js GitHub Bot) #66333 [ 60f4833d41 ] - deps : update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 05470dc308 ] - deps : upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 47333fe4f4 ] - deps : update sqlite to 3.53.4 (Node.js GitHub Bot) #64745 [ 98258b855f ] - deps : update sqlite to 3.53.3 (Node.js GitHub Bot) #64180 [ a8349b6408 ] - deps : update sqlite to 3.53.2 (Node.js GitHub Bot) #63774 [ e9e295bcc1 ] - deps : cherry-pick e807d4e379 from SQLite (Junsu Han) #63525 [ 512a9b61f0 ] - deps : update sqlite to 3.53.1 (Node.js GitHub Bot) #63217 [ e708247254 ] - deps : update sqlite to 3.53.0 (Node.js GitHub Bot) #62699 [ 857be5afa3 ] - deps : update undici to 6.29.1 (Node.js GitHub Bot) #66765 [ 19c5056002 ] - dns : validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 [ e7b2985d59 ] - http : ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 [ 50ab804edc ] - permission : check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 [ a18ec92752 ] - src : expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002 [ 4342503fd8 ] - tls : reject chains containing blocked public keys (Ulises Gascon) #66871 [ d7663560ac ] - tls : reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 [ beb4cd4cd3 ] - tls : match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145 [ 4b42e56aaf ] - tools : retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Lifecycle connections

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Official publisher evidence