NODEJS-26.13.1 release notes and known issues

Summary

This is a security release. Notable Changes ( CVE-2026-123863 ) http2: release headers when a stream is removed (Matteo Collina) – High ( CVE-2026-123864 ) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High ( CVE-2026-123865 ) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High ( CVE-2026-123866 ) http2: retain buffers until socket writes finish (Matteo Collina) – High ( CVE-2026-123872 ) tls: disable resumption for mTLS with no session id context (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow TLS resumption to change SNI (Tim Perry) – High ( CVE-2026-123874 ) http2: retain streams during pending writes (Matteo Collina) – High ( CVE-2026-126051 ) tls: fix remotely reachable TLS server crash (Tim Perry) – High ( CVE-2026-123828 ) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium ( CVE-2026-123867 ) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium ( CVE-2026-123868 ) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium ( CVE-2026-123871 ) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium ( CVE-2026-123875 ) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium ( CVE-2026-123877 ) https: isolate Agent TLS policy keys (Matteo Collina) – Medium ( CVE-2026-123829 ) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low ( CVE-2026-123862 ) zlib: handle params callback after destroy (Matteo Collina) – Low (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low deps: update brotli to 1.2.1 (Node.js GitHub Bot) deps: update llhttp to 9.4.4 (Antoine du Hamel) deps: update sqlite to 3.54.1 (Node.js GitHub Bot) deps: update undici to 8.12.4 (Node.js GitHub Bot) Commits [ 7b777661f5 ] - build : respect OpenSSL's configured API level (Filip Skokan) #66953 [ 4518c7501f ] - crypto : fix builds with older OpenSSL 3.0 (Filip Skokan) #66931 [ 94b73673b8 ] - deps : brotli: cherry-pick e230f474b87 (liujiahui) #61003 [ e315236158 ] - deps : update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038 [ 8e714f7daa ] - deps : update undici to 8.12.4 (Node.js GitHub Bot) #67272 [ af48b1a4d5 ] - deps : update brotli to 1.2.1 (Node.js GitHub Bot) #66990 [ 60316405bb ] - deps : update undici to 8.12.3 (Node.js GitHub Bot) #66993 [ 89b17baef4 ] - deps : update sqlite to 3.54.1 (Node.js GitHub Bot) #66816 [ d14db811c7 ] - http : redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001 [ 9183db64fe ] - http2 : retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040 [ 62ae278a23 ] - http2 : charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000 [ 7df134e2ce ] - http2 : retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017 [ 0ff0cf6749 ] - http2 : release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026 [ a84a01ddb8 ] - http2 : avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035 [ 3fc67dc056 ] - http2 : detect streams abandoned by nghttp2 (Matteo Collina) #66641 [ df4011dafe ] - http2 : guard against null write request on cancelled stream (Matteo Collina) #67252 [ fa61009dc1 ] - https : isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036 [ 40d3d8ddca ] - permission : do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967 [ 6c85b8e371 ] - tls : fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018 [ a8d6286949 ] - tls : disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030 [ e750e1fa02 ] - tls : don't allow renegotiation or

Improvements and security content

• This is a security release. Notable Changes ( CVE-2026-123863 ) http2: release headers when a stream is removed (Matteo Collina) – High ( CVE-2026-123864 ) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High ( CVE-2026-123865 ) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High ( CVE-2026-123866 ) http2: retain buffers until socket writes finish (Matteo Collina) – High ( CVE-2026-123872 ) tls: disable resumption for mTLS with no session id context (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow TLS resumption to change SNI (Tim Perry) – High ( CVE-2026-123874 ) http2: retain streams during pending writes (Matteo Collina) – High ( CVE-2026-126051 ) tls: fix remotely reachable TLS server crash (Tim Perry) – High ( CVE-2026-123828 ) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium ( CVE-2026-123867 ) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium ( CVE-2026-123868 ) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium ( CVE-2026-123871 ) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium ( CVE-2026-123875 ) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium ( CVE-2026-123877 ) https: isolate Agent TLS policy keys (Matteo Collina) – Medium ( CVE-2026-123829 ) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low ( CVE-2026-123862 ) zlib: handle params callback after destroy (Matteo Collina) – Low (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low deps: update brotli to 1.2.1 (Node.js GitHub Bot) deps: update llhttp to 9.4.4 (Antoine du Hamel) deps: update sqlite to 3.54.1 (Node.js GitHub Bot) deps: update undici to 8.12.4 (Node.js GitHub Bot) Commits [ 7b777661f5 ] - build : respect OpenSSL's configured API level (Filip Skokan) #66953 [ 4518c7501f ] - crypto : fix builds with older OpenSSL 3.0 (Filip Skokan) #66931 [ 94b73673b8 ] - deps : brotli: cherry-pick e230f474b87 (liujiahui) #61003 [ e315236158 ] - deps : update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038 [ 8e714f7daa ] - deps : update undici to 8.12.4 (Node.js GitHub Bot) #67272 [ af48b1a4d5 ] - deps : update brotli to 1.2.1 (Node.js GitHub Bot) #66990 [ 60316405bb ] - deps : update undici to 8.12.3 (Node.js GitHub Bot) #66993 [ 89b17baef4 ] - deps : update sqlite to 3.54.1 (Node.js GitHub Bot) #66816 [ d14db811c7 ] - http : redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001 [ 9183db64fe ] - http2 : retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040 [ 62ae278a23 ] - http2 : charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000 [ 7df134e2ce ] - http2 : retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017 [ 0ff0cf6749 ] - http2 : release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026 [ a84a01ddb8 ] - http2 : avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035 [ 3fc67dc056 ] - http2 : detect streams abandoned by nghttp2 (Matteo Collina) #66641 [ df4011dafe ] - http2 : guard against null write request on cancelled stream (Matteo Collina) #67252 [ fa61009dc1 ] - https : isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036 [ 40d3d8ddca ] - permission : do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967 [ 6c85b8e371 ] - tls : fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018 [ a8d6286949 ] - tls : disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030 [ e750e1fa02 ] - tls : don't allow renegotiation or

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Lifecycle connections

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Official publisher evidence