Skip to content

Commit 4547bca

Browse files
aduh95aduh95
committed
2026-06-18, Version 24.17.0 'Krypton' (LTS)
This is a security release. Notable changes: * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low PR-URL: nodejs-private/node-private#899
1 parent 26badaa commit 4547bca

3 files changed

Lines changed: 47 additions & 2 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,8 @@ release.
4747
<a href="doc/changelogs/CHANGELOG_V26.md#26.0.0">26.0.0</a><br/>
4848
</td>
4949
<td valign="top">
50-
<b><a href="doc/changelogs/CHANGELOG_V24.md#24.16.0">24.16.0</a></b><br/>
50+
<b><a href="doc/changelogs/CHANGELOG_V24.md#24.17.0">24.17.0</a></b><br/>
51+
<a href="doc/changelogs/CHANGELOG_V24.md#24.16.0">24.16.0</a><br/>
5152
<a href="doc/changelogs/CHANGELOG_V24.md#24.15.0">24.15.0</a><br/>
5253
<a href="doc/changelogs/CHANGELOG_V24.md#24.14.1">24.14.1</a><br/>
5354
<a href="doc/changelogs/CHANGELOG_V24.md#24.14.0">24.14.0</a><br/>

‎doc/api/errors.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1770,7 +1770,9 @@ as specified through the `maxSessionInvalidFrames` option, has been exceeded.
17701770
### `ERR_HTTP2_TOO_MANY_ORIGINS`
17711771

17721772
<!-- YAML
1773-
added: v22.23.0
1773+
added:
1774+
- v24.17.0
1775+
- v22.23.0
17741776
-->
17751777

17761778
The number of uniq origin sent by the server has exceeded the value defined in

‎doc/changelogs/CHANGELOG_V24.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
</tr>
1010
<tr>
1111
<td>
12+
<a href="#24.17.0">24.17.0</a><br/>
1213
<a href="#24.16.0">24.16.0</a><br/>
1314
<a href="#24.15.0">24.15.0</a><br/>
1415
<a href="#24.14.1">24.14.1</a><br/>
@@ -66,6 +67,47 @@
6667
* [io.js](CHANGELOG_IOJS.md)
6768
* [Archive](CHANGELOG_ARCHIVE.md)
6869

70+
<a id="24.17.0"></a>
71+
72+
## 2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95
73+
74+
This is a security release.
75+
76+
### Notable Changes
77+
78+
* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
79+
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
80+
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
81+
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
82+
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
83+
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
84+
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
85+
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
86+
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
87+
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
88+
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
89+
90+
### Commits
91+
92+
* \[[`9e4dfc7bba`](https://github.com/nodejs/node/commit/9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
93+
* \[[`cb2aed980c`](https://github.com/nodejs/node/commit/cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
94+
* \[[`a8a0d12875`](https://github.com/nodejs/node/commit/a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#62891](https://github.com/nodejs/node/pull/62891)
95+
* \[[`66e6203c1c`](https://github.com/nodejs/node/commit/66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#62891](https://github.com/nodejs/node/pull/62891)
96+
* \[[`dd627ced27`](https://github.com/nodejs/node/commit/dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
97+
* \[[`684bae568f`](https://github.com/nodejs/node/commit/684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
98+
* \[[`3a631e7f83`](https://github.com/nodejs/node/commit/3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#62656](https://github.com/nodejs/node/pull/62656)
99+
* \[[`cf44df3996`](https://github.com/nodejs/node/commit/cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#63703](https://github.com/nodejs/node/pull/63703)
100+
* \[[`138c70294b`](https://github.com/nodejs/node/commit/138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
101+
* \[[`be7e719c3f`](https://github.com/nodejs/node/commit/be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
102+
* \[[`cc7c11b4d1`](https://github.com/nodejs/node/commit/cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
103+
* \[[`9224427b92`](https://github.com/nodejs/node/commit/9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
104+
* \[[`cf85d54839`](https://github.com/nodejs/node/commit/cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
105+
* \[[`a1bbc24f96`](https://github.com/nodejs/node/commit/a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870)
106+
* \[[`e3723ff2d6`](https://github.com/nodejs/node/commit/e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
107+
* \[[`a77af4867b`](https://github.com/nodejs/node/commit/a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
108+
* \[[`31beb4f707`](https://github.com/nodejs/node/commit/31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857)
109+
* \[[`8e75c73f91`](https://github.com/nodejs/node/commit/8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869)
110+
69111
<a id="24.16.0"></a>
70112

71113
## 2026-05-21, Version 24.16.0 'Krypton' (LTS), @aduh95

0 commit comments

Comments
 (0)