Skip to content

Commit 141d9f1

Browse files
juanarbolRafaelGSS
juanarbol
authored and
RafaelGSS
committed
2026-03-24, Version 24.14.1 'Krypton' (LTS)
This is a security release. Notable changes: build,deps,test: * (CVE-2026-21717) test array index hash collision crypto: * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC http: * (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct permission: * (CVE-2026-21716) include permission check on lib/fs/promises * (CVE-2026-21715) add permission check to realpath.native src: * (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code * (CVE-2026-21712) handle url crash on different url formats tls: * (CVE-2026-21637) wrap SNICallback invocation in try/catch PR-URL: nodejs-private/node-private#837
1 parent d2be89c commit 141d9f1

File tree

2 files changed

+77
-13
lines changed

2 files changed

+77
-13
lines changed

‎CHANGELOG.md‎

Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,45 @@ release.
4141
</tr>
4242
<tr>
4343
<td valign="top">
44-
<b><a href="doc/changelogs/CHANGELOG_V22.md#22.22.2">22.22.2</a></b><br/>
45-
<a href="doc/changelogs/CHANGELOG_V22.md#22.22.1">22.22.1</a><br/>
46-
<a href="doc/changelogs/CHANGELOG_V22.md#22.22.0">22.22.0</a><br/>
47-
<a href="doc/changelogs/CHANGELOG_V22.md#22.21.1">22.21.1</a><br/>
48-
<a href="doc/changelogs/CHANGELOG_V22.md#22.21.0">22.21.0</a><br/>
49-
<a href="doc/changelogs/CHANGELOG_V22.md#22.20.0">22.20.0</a><br/>
50-
<a href="doc/changelogs/CHANGELOG_V22.md#22.19.0">22.19.0</a><br/>
51-
<a href="doc/changelogs/CHANGELOG_V22.md#22.18.0">22.18.0</a><br/>
52-
<a href="doc/changelogs/CHANGELOG_V22.md#22.17.1">22.17.1</a><br/>
53-
<a href="doc/changelogs/CHANGELOG_V22.md#22.17.0">22.17.0</a><br/>
54-
<a href="doc/changelogs/CHANGELOG_V22.md#22.16.0">22.16.0</a><br/>
55-
<a href="doc/changelogs/CHANGELOG_V22.md#22.15.1">22.15.1</a><br/>
56-
<a href="doc/changelogs/CHANGELOG_V22.md#22.15.0">22.15.0</a><br/>
44+
<b><a href="doc/changelogs/CHANGELOG_V24.md#24.14.1">24.14.1</a></b><br/>
45+
<a href="doc/changelogs/CHANGELOG_V24.md#24.14.0">24.14.0</a><br/>
46+
<a href="doc/changelogs/CHANGELOG_V24.md#24.13.1">24.13.1</a><br/>
47+
<a href="doc/changelogs/CHANGELOG_V24.md#24.13.0">24.13.0</a><br/>
48+
<a href="doc/changelogs/CHANGELOG_V24.md#24.12.0">24.12.0</a><br/>
49+
<a href="doc/changelogs/CHANGELOG_V24.md#24.11.1">24.11.1</a><br/>
50+
<a href="doc/changelogs/CHANGELOG_V24.md#24.11.0">24.11.0</a><br/>
51+
<a href="doc/changelogs/CHANGELOG_V24.md#24.10.0">24.10.0</a><br/>
52+
<a href="doc/changelogs/CHANGELOG_V24.md#24.9.0">24.9.0</a><br/>
53+
<a href="doc/changelogs/CHANGELOG_V24.md#24.8.0">24.8.0</a><br/>
54+
<a href="doc/changelogs/CHANGELOG_V24.md#24.7.0">24.7.0</a><br/>
55+
<a href="doc/changelogs/CHANGELOG_V24.md#24.6.0">24.6.0</a><br/>
56+
<a href="doc/changelogs/CHANGELOG_V24.md#24.5.0">24.5.0</a><br/>
57+
<a href="doc/changelogs/CHANGELOG_V24.md#24.4.1">24.4.1</a><br/>
58+
<a href="doc/changelogs/CHANGELOG_V24.md#24.4.0">24.4.0</a><br/>
59+
<a href="doc/changelogs/CHANGELOG_V24.md#24.3.0">24.3.0</a><br/>
60+
<a href="doc/changelogs/CHANGELOG_V24.md#24.2.0">24.2.0</a><br/>
61+
<a href="doc/changelogs/CHANGELOG_V24.md#24.1.0">24.1.0</a><br/>
62+
<a href="doc/changelogs/CHANGELOG_V24.md#24.0.2">24.0.2</a><br/>
63+
<a href="doc/changelogs/CHANGELOG_V24.md#24.0.1">24.0.1</a><br/>
64+
<a href="doc/changelogs/CHANGELOG_V24.md#24.0.0">24.0.0</a><br/>
65+
</td>
66+
<td valign="top">
67+
<b><a href="doc/changelogs/CHANGELOG_V23.md#23.11.0">23.11.0</a></b><br/>
68+
<a href="doc/changelogs/CHANGELOG_V23.md#23.10.0">23.10.0</a><br/>
69+
<a href="doc/changelogs/CHANGELOG_V23.md#23.9.0">23.9.0</a><br/>
70+
<a href="doc/changelogs/CHANGELOG_V23.md#23.8.0">23.8.0</a><br/>
71+
<a href="doc/changelogs/CHANGELOG_V23.md#23.7.0">23.7.0</a><br/>
72+
<a href="doc/changelogs/CHANGELOG_V23.md#23.6.1">23.6.1</a><br/>
73+
<a href="doc/changelogs/CHANGELOG_V23.md#23.6.0">23.6.0</a><br/>
74+
<a href="doc/changelogs/CHANGELOG_V23.md#23.5.0">23.5.0</a><br/>
75+
<a href="doc/changelogs/CHANGELOG_V23.md#23.4.0">23.4.0</a><br/>
76+
<a href="doc/changelogs/CHANGELOG_V23.md#23.3.0">23.3.0</a><br/>
77+
<a href="doc/changelogs/CHANGELOG_V23.md#23.2.0">23.2.0</a><br/>
78+
<a href="doc/changelogs/CHANGELOG_V23.md#23.1.0">23.1.0</a><br/>
79+
<a href="doc/changelogs/CHANGELOG_V23.md#23.0.0">23.0.0</a><br/>
80+
</td>
81+
<td valign="top">
82+
<b><a href="doc/changelogs/CHANGELOG_V22.md#22.15.0">22.15.0</a></b><br/>
5783
<a href="doc/changelogs/CHANGELOG_V22.md#22.14.0">22.14.0</a><br/>
5884
<a href="doc/changelogs/CHANGELOG_V22.md#22.13.1">22.13.1</a><br/>
5985
<a href="doc/changelogs/CHANGELOG_V22.md#22.13.0">22.13.0</a><br/>

‎doc/changelogs/CHANGELOG_V24.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
</tr>
1010
<tr>
1111
<td>
12+
<a href="#24.14.1">24.14.1</a><br/>
1213
<a href="#24.14.0">24.14.0</a><br/>
1314
<a href="#24.13.1">24.13.1</a><br/>
1415
<a href="#24.13.0">24.13.0</a><br/>
@@ -62,6 +63,43 @@
6263
* [io.js](CHANGELOG_IOJS.md)
6364
* [Archive](CHANGELOG_ARCHIVE.md)
6465

66+
<a id="24.14.1"></a>
67+
68+
## 2026-03-24, Version 24.14.1 'Krypton' (LTS), @RafaelGSS prepared by @juanarbol
69+
70+
This is a security release.
71+
72+
### Notable Changes
73+
74+
* (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
75+
* (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
76+
* (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
77+
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
78+
* (CVE-2026-21714) handle NGHTTP2\_ERR\_FLOW\_CONTROL error code (RafaelGSS) - Medium
79+
* (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
80+
* (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
81+
* (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
82+
83+
### Commits
84+
85+
* \[[`6fae244080`](https://github.com/nodejs/node/commit/6fae244080)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#828](https://github.com/nodejs-private/node-private/pull/828)
86+
* \[[`cc0910c62e`](https://github.com/nodejs/node/commit/cc0910c62e)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
87+
* \[[`80cb042cf3`](https://github.com/nodejs/node/commit/80cb042cf3)] - **deps**: update undici to 7.24.4 (Node.js GitHub Bot) [#62271](https://github.com/nodejs/node/pull/62271)
88+
* \[[`f5b8667dc2`](https://github.com/nodejs/node/commit/f5b8667dc2)] - **deps**: update undici to 7.24.3 (Node.js GitHub Bot) [#62233](https://github.com/nodejs/node/pull/62233)
89+
* \[[`08852637d9`](https://github.com/nodejs/node/commit/08852637d9)] - **deps**: update undici to 7.22.0 (Node.js GitHub Bot) [#62035](https://github.com/nodejs/node/pull/62035)
90+
* \[[`61097db9fb`](https://github.com/nodejs/node/commit/61097db9fb)] - **deps**: upgrade npm to 11.11.0 (npm team) [#61994](https://github.com/nodejs/node/pull/61994)
91+
* \[[`9ac0f9f81e`](https://github.com/nodejs/node/commit/9ac0f9f81e)] - **deps**: upgrade npm to 11.10.1 (npm team) [#61892](https://github.com/nodejs/node/pull/61892)
92+
* \[[`3dab3c4698`](https://github.com/nodejs/node/commit/3dab3c4698)] - **deps**: V8: override `depot_tools` version (Richard Lau) [#62344](https://github.com/nodejs/node/pull/62344)
93+
* \[[`87521e99d1`](https://github.com/nodejs/node/commit/87521e99d1)] - **deps**: V8: backport 1361b2a49d02 (Joyee Cheung) [nodejs-private/node-private#828](https://github.com/nodejs-private/node-private/pull/828)
94+
* \[[`045013366f`](https://github.com/nodejs/node/commit/045013366f)] - **deps**: V8: backport 185f0fe09b72 (Joyee Cheung) [nodejs-private/node-private#828](https://github.com/nodejs-private/node-private/pull/828)
95+
* \[[`af22629ea8`](https://github.com/nodejs/node/commit/af22629ea8)] - **deps**: V8: backport 0a8b1cdcc8b2 (snek) [nodejs-private/node-private#828](https://github.com/nodejs-private/node-private/pull/828)
96+
* \[[`380ea72eef`](https://github.com/nodejs/node/commit/380ea72eef)] - **(CVE-2026-21710)** **http**: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) [nodejs-private/node-private#821](https://github.com/nodejs-private/node-private/pull/821)
97+
* \[[`d6b6051e08`](https://github.com/nodejs/node/commit/d6b6051e08)] - **(CVE-2026-21716)** **permission**: include permission check on lib/fs/promises (RafaelGSS) [nodejs-private/node-private#795](https://github.com/nodejs-private/node-private/pull/795)
98+
* \[[`bfdecef9da`](https://github.com/nodejs/node/commit/bfdecef9da)] - **(CVE-2026-21715)** **permission**: add permission check to realpath.native (RafaelGSS) [nodejs-private/node-private#794](https://github.com/nodejs-private/node-private/pull/794)
99+
* \[[`c015edf313`](https://github.com/nodejs/node/commit/c015edf313)] - **(CVE-2026-21714)** **src**: handle NGHTTP2\_ERR\_FLOW\_CONTROL error code (RafaelGSS) [nodejs-private/node-private#832](https://github.com/nodejs-private/node-private/pull/832)
100+
* \[[`cba66c48a5`](https://github.com/nodejs/node/commit/cba66c48a5)] - **(CVE-2026-21712)** **src**: handle url crash on different url formats (RafaelGSS) [nodejs-private/node-private#816](https://github.com/nodejs-private/node-private/pull/816)
101+
* \[[`df8fbfb93d`](https://github.com/nodejs/node/commit/df8fbfb93d)] - **(CVE-2026-21637)** **tls**: wrap SNICallback invocation in try/catch (Matteo Collina) [nodejs-private/node-private#819](https://github.com/nodejs-private/node-private/pull/819)
102+
65103
<a id="24.14.0"></a>
66104

67105
## 2026-02-24, Version 24.14.0 'Krypton' (LTS), @ruyadorno prepared by @aduh95

0 commit comments

Comments
 (0)