Node.js 26.5.1 (Current)

Rafael Gonzaga 2026-07-29, Version 26.5.1 (Current), @RafaelGSS This is a security release.

Notable Changes (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low deps: update llhttp to 9.4.3 (Paolo Insogna) deps: update undici to 8.9.0 (Node.js GitHub Bot) Commits [af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935 [0354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #64712 [dbeeaeec13] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929 [064d339f56] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922 [23b94c843a] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921 [c7ec3dc0b9] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904 [8f666925b1] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930 [ad99d075b1] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911 [61222008b7] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#908 [3cb607dfc4] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#924 [d08fde8a16] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896 [b3fbb6e11f] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931 Windows 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1-x64.msi Windows ARM 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1-arm64.msi Windows 64-bit Binary: https://nodejs.org/dist/v26.5.1/win-x64/node.exe Windows ARM 64-bit Binary: https://nodejs.org/dist/v26.5.1/win-arm64/node.exe macOS 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1.pkg macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-darwin-arm64.tar.gz macOS Intel 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-darwin-x64.tar.gz Linux 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-x64.tar.xz Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-ppc64le.tar.xz Linux s390x 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-s390x.tar.xz AIX 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-aix-ppc64.tar.gz ARMv8 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-arm64.tar.xz Source Code: https://nodejs.org/dist/v26.5.1/node-v26.5.1.tar.gz Other release files: https://nodejs.org/dist/v26.5.1/ Documentation: https://nodejs.org/docs/v26.5.1/api/ SHASUMS -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 0bafe816b17bcaee285e79e325b7a44eea605d12d81b2caa78cddcadf5d1b5f6 node-v26.5.1-aix-ppc64.tar.gz 01875f52263953ad81972d304263f36a71e5e97873fa9fa60989e8973d18d00b node-v26.5.1-arm64.msi f4387df0b46556516d19abf2f2d6806481ac8368aa7f9d96bafed422a56a1d01 node-v26.5.1-darwin-arm64.tar.gz f4665a1e764653ec6fe7686309e8907e9ebb9ba68c4b88b9185fdc29f221559b node-v26.5.1-darwin-arm64.tar.xz 077d5c936868dab19d21f77f1e71ce13697e80b3e86a399dcab238902a2ebf93 node-v26.5.1-darwin-x64.tar.gz 4436be8db0e2bd5ca3dee8c48aa8a157c9a8fef99580036ff1da8ef6aba44708 node-v26.5.1-darwin-x64.tar.xz 598a3139679db65461f8af50463d668008eaee5e0d09df4eeaa27f3eeefecc03 node-v26.5.1-headers.tar.gz f72d24a5a34b40ba738f6d28cdcd50e3f4976558d4f14bebfa64fdbdcfc4951a node-v26.5.1-headers.tar.xz 21194bbf41c18d9ec277545c4d14cce8597d57a9d9f494c323d8121a25de33e8 node-v26.5.1-linux-arm64.tar.gz 0b6b0cc2a1eecbe736f9918de8b5a6c9a48d286b88bec1298a3c1e3376182ea8 node-v26.5.1-linux-arm64.tar.xz cf518dd2772ea7e5046daf4a4ba9e348fce01e2b9741f32ba21b4bbd87b8dfaf node-v26.5.1-linux-ppc64le.tar.gz 692d0c45896bf232e22b8b64a4a826ed0a70fec75545f208d120c109d0a86752 node-v26.5.1-linux-ppc64le.tar.xz af5a58fca0c3fc130c6a649bd6c29f4b000145055eb7a364bde189abdf1516f5 node-v26.5.1-linux-s390x.tar.gz ff4635062f82308dda7c7164337ad9bb383568dac984ff64b35b888e7d7a4ef3 node-v26.5.1-linux-s390x.tar.xz 2b07f09c218d473a26442bff5a90151f53f7b7c0a23bad244eda2c26303a2ba7 node-v26.5.1-linux-x64.tar.gz cc7b3484ade63bd203a9d304f21ec37a3b622b988d7bdecf1dc4d68fc44a91b7 node-v26.5.1-linux-x64.tar.xz a6e6cfdb0af6d7d68b50a6f663b8ff321923089309076ea7943a19dbe5eb662a node-v26.5.1-win-arm64.7z 467f425228a2fdcc83a330f5f38b124b5b43b42f5033d7848b4e47c9becc36f9 node-v26.5.1-win-arm64.zip 0c8a1a3604e57400432089cf7e179eac4f25b26445a156aaa98cca5619e50f5c node-v26.5.1-win-x64.7z c432c996b95cbf7568f13a0fbb37526de84a27e3a5c520c3be15f05a9a168212 node-v26.5.1-win-x64.zip 826a4551bb9d3c00c61c17a2521a1e901ac7304e3090a3c2d07c1e0fe2b4d60d node-v26.5.1-x64.msi ae175856e12aadc081a539af37a70a71d3233b2e710fa00266137e23e24faca2 node-v26.5.1.pkg 1143281232fc4640188aaa20afb0f9c4f06031f554cd3f1e5ac86e8a0387511a node-v26.5.1.tar.gz df7770a9a99346f8b73ba6d31ad89bd6f868b51c7387c3627dcb44ca065f4948 node-v26.5.1.tar.xz c6ca33154ee426f46e02aa9f5676d69b768808b564aa22652fe18bb08c188fe5 win-arm64/node.exe c01ce0d5e4e956f0e5e73cdba925d15a6d6f86883aa49f8f0b0de87aa93508ce win-arm64/node.lib 83961c8a59f1771a2e0ffcf89487b3fa0a7ca18a69f1061683c27671b36665e5 win-arm64/node_pdb.7z 7b40fa280b35d3aef700852220075f262a25c4cdd9a6f90fb8a3a4b1bed9cf8b win-arm64/node_pdb.zip b48b0224081224cda1f49374e2fc63d143041ade51754f0cc6608fe8510ba29e win-x64/node.exe 56f06350037085fce04930befd98327afc86ee46f52af6f6f8a68a03630e8380 win-x64/node.lib cbd18315c40cb831d1a398c0df64a43876999e77eb56b52589b64ee8a5bf93d0 win-x64/node_pdb.7z fb3b232e033a25d0aae20c0413589569688807471e98a1620ef7f7ec959fbf83 win-x64/node_pdb.zip -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmpqCAYACgkQi+q0389V XvRsRwv9Gscq3A1VqXWzAWdyE+tWyMGYTSzisHRRudAmDVkUoEK/WHfgmbmFXXDC IjokChhRdJL4I3DFSq8sntybzGMYb1hqwvPRr9fRCW+6dsVT1eNnb8OQWObqONaq w8F82T+mSk8D4ZSH7Q9IMGBZBzln3oRBwXuHOUcYMtnMEKgHsP35Li4HARaKWMGE enlNvp+r9PxHMKXtKl5cFygqh0slhEHJQ/6GzKKNRbSFTpEBkQbtIEaFib7XHguv 6uUj0R0ZhCXrcYzlxhL6KIGHes0jMIRwkM9C3b7Q2c9Jw0PuglhCPdD+VZI1dIU6 7j8f/jyncIZMXE5FNnldwMy9aiA/xcOenTEA/F2yBEM+ErrWf8r7tLQk0JfqmZ1M qfqHHb2zu2ywcHspOS6Lhn+1wE47rEKAdYYt7iRA4L86TASCie1K8hgrsIJE5z5D dv02pgX3Oj2hLsCun3PfH6a0MSYXIDCwelz3wn8uWl5tN8pH4F0eLZWJ04sjXvdb ySj7vo4t =wksr -----END PGP SIGNATURE-----