BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
RELEASE NOTESOPENJS FOUNDATIONVERIFIED

PUBLISHER UPDATE · NODEJS-24.22.1

NODEJS-24.22.1 release notes and known issues

2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95

Scope: Node.js. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

This is a security release. Notable Changes ( CVE-2026-105481 ) http: ensure agent data guard works without I/O (James M Snell) ( CVE-2026-105482 ) dns: validate resolve inputs for null bytes (James M Snell) ( CVE-2026-105483 ) tls: fix ip normalization regression (James M Snell) ( CVE-2026-106069 ) tls: reject non-canonical IP addresses (Matteo Collina) ( CVE-2026-106073 ) permission: check permission model in realpathSync (RafaelGSS) ( CVE-2026-106074 ) crypto: reset random caches across snapshots (Filip Skokan) ( CVE-2026-111497 ) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) ( CVE-2026-111497 ) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) deps: update c-ares to 1.34.9 (Node.js GitHub Bot) deps: update timezone to 2026e (Node.js GitHub Bot) deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) deps: update undici to 7.30.1 (Node.js GitHub Bot) Commits [ 2a73ee5a89 ] - crypto : update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 [ 4d6990b33c ] - crypto : reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 [ 4b3c9bbf9f ] - crypto : harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007 [ 9243b105b6 ] - crypto : update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 [ 1e39cd53c7 ] - deps : update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 [ 49dff6f57a ] - deps : brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 [ fca511adc5 ] - deps : V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008 [ 18711c7567 ] - deps : update timezone to 2026e (Node.js GitHub Bot) #66419 [ fa77cfb1ad ] - deps : update timezone to 2026d (Node.js GitHub Bot) #66333 [ b84f9f186b ] - deps : update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 [ ff0664c3ba ] - deps : upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 1d4c89ef87 ] - deps : update undici to 7.30.1 (Node.js GitHub Bot) #66764 [ 843a1627dc ] - dns : validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 [ 96c3ccb1fc ] - http : ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 [ 8dc18a6218 ] - permission : check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 [ b5f41529df ] - src : expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002 [ 01acf0ee74 ] - tls : reject chains containing blocked public keys (Ulises Gascón) #66871 [ 935918e342 ] - tls : reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 [ de49c913f2 ] - tls : fix ip normalization regression (James M Snell) nodejs-private/node-private#985 [ 9dc4bb57f0 ] - tools : retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

Improvements and security content

  • This is a security release. Notable Changes ( CVE-2026-105481 ) http: ensure agent data guard works without I/O (James M Snell) ( CVE-2026-105482 ) dns: validate resolve inputs for null bytes (James M Snell) ( CVE-2026-105483 ) tls: fix ip normalization regression (James M Snell) ( CVE-2026-106069 ) tls: reject non-canonical IP addresses (Matteo Collina) ( CVE-2026-106073 ) permission: check permission model in realpathSync (RafaelGSS) ( CVE-2026-106074 ) crypto: reset random caches across snapshots (Filip Skokan) ( CVE-2026-111497 ) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) ( CVE-2026-111497 ) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) deps: update c-ares to 1.34.9 (Node.js GitHub Bot) deps: update timezone to 2026e (Node.js GitHub Bot) deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) deps: update undici to 7.30.1 (Node.js GitHub Bot) Commits [ 2a73ee5a89 ] - crypto : update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 [ 4d6990b33c ] - crypto : reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 [ 4b3c9bbf9f ] - crypto : harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007 [ 9243b105b6 ] - crypto : update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 [ 1e39cd53c7 ] - deps : update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 [ 49dff6f57a ] - deps : brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 [ fca511adc5 ] - deps : V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008 [ 18711c7567 ] - deps : update timezone to 2026e (Node.js GitHub Bot) #66419 [ fa77cfb1ad ] - deps : update timezone to 2026d (Node.js GitHub Bot) #66333 [ b84f9f186b ] - deps : update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 [ ff0664c3ba ] - deps : upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 1d4c89ef87 ] - deps : update undici to 7.30.1 (Node.js GitHub Bot) #66764 [ 843a1627dc ] - dns : validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 [ 96c3ccb1fc ] - http : ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 [ 8dc18a6218 ] - permission : check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 [ b5f41529df ] - src : expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002 [ 01acf0ee74 ] - tls : reject chains containing blocked public keys (Ulises Gascón) #66871 [ 935918e342 ] - tls : reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 [ de49c913f2 ] - tls : fix ip normalization regression (James M Snell) nodejs-private/node-private#985 [ 9dc4bb57f0 ] - tools : retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Node.js

Affected versions

  • 24.22.1
  • 3.131.1
  • 1.34.9
  • 3.5.9
  • 7.30.1
  • 3.129

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Related vulnerabilities

BlackTree CVE Intelligence
CVE-2026-105481Open CVE report →CVE-2026-105482Open CVE report →CVE-2026-105483Open CVE report →CVE-2026-106069Open CVE report →CVE-2026-106073Open CVE report →CVE-2026-106074Open CVE report →CVE-2026-111497Open CVE report →

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Node.js 22 JodOpen lifecycle record →

Official publisher evidence

OPENJS FOUNDATIONVERIFIED

2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95

Checked 15 Nov 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source