Node.js 22.23.2 (LTS)

Marco Ippolito 2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolito This is a security release.

Notable Changes (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low deps: update llhttp to 9.4.3 (Paolo Insogna) deps: update undici to 6.28.0 (Node.js GitHub Bot) Commits [4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935 [3fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #64714 [22efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929 [c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932 [daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921 [f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752 [51123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934 [acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930 [440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911 [ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926 [0566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927 [0d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931 Windows 32-bit Installer: https://nodejs.org/dist/v22.23.2/node-v22.23.2-x86.msi Windows 64-bit Installer: https://nodejs.org/dist/v22.23.2/node-v22.23.2-x64.msi Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.23.2/node-v22.23.2-arm64.msi Windows 32-bit Binary: https://nodejs.org/dist/v22.23.2/win-x86/node.exe Windows 64-bit Binary: https://nodejs.org/dist/v22.23.2/win-x64/node.exe Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.23.2/win-arm64/node.exe macOS 64-bit Installer: https://nodejs.org/dist/v22.23.2/node-v22.23.2.pkg macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-darwin-arm64.tar.gz macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-darwin-x64.tar.gz Linux 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-x64.tar.xz Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-ppc64le.tar.xz Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-s390x.tar.xz AIX 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-aix-ppc64.tar.gz ARMv7 32-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-armv7l.tar.xz ARMv8 64-bit Binary: https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-arm64.tar.xz Source Code: https://nodejs.org/dist/v22.23.2/node-v22.23.2.tar.gz Other release files: https://nodejs.org/dist/v22.23.2/ Documentation: https://nodejs.org/docs/v22.23.2/api/ SHASUMS -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 77c63032fd4ab8e98e0ae7db9d79e396659e04af95a5edf8e1ca869e426c04a5 node-v22.23.2-aix-ppc64.tar.gz 963c0f779d8f893f17f6b2a0060932c366ffa59f7c79527748a9c558c152dd38 node-v22.23.2-arm64.msi 61130f394c1630d211dd50aecc4353d379480f36d3ac913cd85dbba1aed585c6 node-v22.23.2-darwin-arm64.tar.gz 5eff7a9011895aae3f29d06f167b84a62b028a591370c7cafb59103559fd26e1 node-v22.23.2-darwin-arm64.tar.xz 58e99022c2ff89395576cc7fd4d98cea24bb68081475d5f88b801ee8729fb026 node-v22.23.2-darwin-x64.tar.gz 96dff79f4e19a78715da559ec7cac2028f4985a175ea0c3454625a269c21deb7 node-v22.23.2-darwin-x64.tar.xz daaf13ec5d45a38bbcfcff06d0723f72a6813b89ab27bb5af2ac8e1f6259dde0 node-v22.23.2-headers.tar.gz b141dcc466e2bc15bbc57602898915cf7b73bff974e72a357b1e2e3a4cfbd2e5 node-v22.23.2-headers.tar.xz 013b59cfd2819703a6f4a14ab891fc46fc2a4e3f5bcd92de3fb4929b43e35b30 node-v22.23.2-linux-arm64.tar.gz fff4078c5def658577f92c88db7db3bc0072924bfb93fe52c1e744a54e94abb8 node-v22.23.2-linux-arm64.tar.xz 2a2f59eb8fd9dec27b3bee17c729131d1fd3e6d9943d479f1156ce38af8cd599 node-v22.23.2-linux-armv7l.tar.gz ef8f26a3de19acd8c23548e6c3cfc2052610b0e67abb5fd64dbd92c8b1c1245b node-v22.23.2-linux-armv7l.tar.xz 65c8aa9e647196f30d3564bb6b201306b1b520f72f0dd3278da326014a018379 node-v22.23.2-linux-ppc64le.tar.gz e2ba10110ad34096c051fe47134fcd12175ecc48e7e879d7d4c78b70cf66442c node-v22.23.2-linux-ppc64le.tar.xz 986b8441b1d1a01c70ed710bab201741fd0d196d302a7e4338fefd5e1c10e61e node-v22.23.2-linux-s390x.tar.gz 50aa0935c7caee2f95434f84c2c19f16e4f223257eadb341a3a2d5aaa545bbe6 node-v22.23.2-linux-s390x.tar.xz b294a556e639d64338823920e5866c21c02741742d2e1529ee1a225c1ec9252a node-v22.23.2-linux-x64.tar.gz d60acfe00a2932254bb0ad20e01b0d74397a0875595de719654b214f4b03f307 node-v22.23.2-linux-x64.tar.xz 0422d63395d28cad31d92a202b8a5ff76d3bf09f234786926622bde7fe2d7a89 node-v22.23.2.pkg cdaed46fcd8923a55974b7bbc7caaadeaaf7aed60cc137e59837b72f575ef641 node-v22.23.2.tar.gz bbe768df8d5815d7fa76124052985332452e0a4742d39f32027550d1aab8f6fb node-v22.23.2.tar.xz f8bdc72090f0e13223c6b974cb0a2919be9650f27f45223df4bb78231df3fb7c node-v22.23.2-win-arm64.7z fec025a6da31757e3b6af84c5a1628e9d38442ca99a2161091d78f2fcfa35ef3 node-v22.23.2-win-arm64.zip 4f72483c39634934c77b1ece25911d84d2a929d6171751ea701d13f348368838 node-v22.23.2-win-x64.7z 1177b4137ba5adaa56354ae40f1080c7450e8ae09cecb47da459d1c52ac99f97 node-v22.23.2-win-x64.zip 211b8539e37b4f0a31d11016bdb882f036b1f3bcd2da879f365e0d712d7973a1 node-v22.23.2-win-x86.7z 725c9e2bdd1c2016b41c995a81f4fa36ce4e2ee565b7455d8f889182727df647 node-v22.23.2-win-x86.zip ce9572ae220c345fbae2340bbb4d084e8ca5e0fe093ee7067d43094ae23be989 node-v22.23.2-x64.msi bacc6689c6b6953e120fedaf0bba9f16349bb2755f6ee9fecf33317daab9d029 node-v22.23.2-x86.msi 97cce5301a815d2dce07ac5bfd1e6039eae88185ec1d10ae4f8cb712f1732878 win-arm64/node.exe e56e62f4a7ae6643a40db01f09072e8a93ccbe73be8abff927b793344691d6b7 win-arm64/node.lib 42263b4322f459ad5c665a1569e77a53125853f43069ded98432bbdb29378fab win-arm64/node_pdb.7z 9b1d825eebb86b58829d72ce3b0c28a84d80bf7e2204c835e1ec99a8729559df win-arm64/node_pdb.zip 0d0f5e39f9f3d9587bc19f73eab3c2c9c4903fd02d6dbf9c853dd81b3d95fad4 win-x64/node.exe ac15f1e9d7c8279353723a77f6319967f1a41c06026521094a8234c2e6fbe052 win-x64/node.lib bf6be5c7dae68227e6fd6a105aa5b2eb8b3511a6f1ab4488f27ce36b85d66f30 win-x64/node_pdb.7z f5836a84ab8aa5ecf5e5e415cf8fa92c2b8fc11c3128e9225877c2628dd00318 win-x64/node_pdb.zip ae3f4245f4b87a79b1a9f66fbede12f526adc3dea9c4bdb50d66ed8c88eb395a win-x86/node.exe 66949ba371a159f5e3626f6ce960f85ab6bcdd237eafcdfbc11d1377a2767652 win-x86/node.lib 754c6fa0c493d19baa93cccf25668637b48b46edb810f604034c87cf7a1c3ed7 win-x86/node_pdb.7z 65d6b0a8590eb1401bb6756d63b0ab12db3c31bc0ce71a892e3079c8fdeca305 win-x86/node_pdb.zip -----BEGIN PGP SIGNATURE----- iQJPBAEBCAA5FiEEzGj1oxBv9EgyLkjtJ/XjjVsKIV8FAmpqBnEbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJECf1441bCiFfLkYQAI5Lu6hHMJGYjWieVVc3 izv4gfMxrwr4doLo4DTVywRE7ZdKd8ylgmWQ4lfHK4XAmRDnZfm5dMtK6xDRkqBi AVAKIvBznIOvNMoCQvj8dKUqLTOpmTBS0chARWwq6WqQSUnTAfvejDHD7QEo/jYm 04mfdOFupcU/RnnBTlNLNMgye1F8owj2MjccvjRkA/ML7LSY7esYgLPfeulVY+k8 VcJ1xcaIzr/tgbURyIxzfkmoY+urebvPAAsVGZoDBjMelUmX5xs1PXO+jy4uNMg4 JT/qI3Oadn4OYkhNczWtaB4j5HhFxtkY8CFek8k1c+1XpWw1KvfbHMhd/O81Tq4W hHFIeKyEYKG2DApAYDcfouPprknnC8gAp7xnMZvTHsdqWCxbgCXw24Der3t74KpS FyIB1DhpL6x9cQ7gSWPo4SlThalUBJhqUDZIlnarafPzs2mywP4FeDlSwv/f44u0 xpeP9BBjB3PoHGQ+MMDqpTNEBGZoo8pf3fmPwCv3W41LOiHy6Tce0NgLImCJXpaj AxO0LL+BFEDr4qasfOMQkU+r2uSlPLdeSx7MLVziy4yLUF5WDKc5fdEJlxyhMA+5 8AQY65xR+Jfrl9s3M7I2PYtN7+yzwvJrU+AhCDujSoxzWFII8aITKyrsrgJ+4Z4B dTZJ6z2spVlbPqiFdhAGjbk8 =TLBg -----END PGP SIGNATURE-----