Skip to content

Commit d2be89c

Browse files
aduh95RafaelGSS
aduh95
authored and
RafaelGSS
committed
2026-03-24, Version 22.22.2 'Jod' (LTS)
This is a security release. Notable changes: build,test,deps: * (CVE-2026-21717) test array index hash collision crypto: * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC http: * (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct permission: * (CVE-2026-21716) include permission check on lib/fs/promises * (CVE-2026-21715) add permission check to realpath.native src: * (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code tls: * (CVE-2026-21637) wrap SNICallback invocation in try/catch PR-URL: nodejs-private/node-private#844
1 parent 8e8b98d commit d2be89c

File tree

2 files changed

+38
-37
lines changed

2 files changed

+38
-37
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -41,43 +41,8 @@ release.
4141
</tr>
4242
<tr>
4343
<td valign="top">
44-
<b><a href="doc/changelogs/CHANGELOG_V25.md#25.8.1">25.8.1</a></b><br/>
45-
<a href="doc/changelogs/CHANGELOG_V25.md#25.8.0">25.8.0</a><br/>
46-
<a href="doc/changelogs/CHANGELOG_V25.md#25.7.0">25.7.0</a><br/>
47-
<a href="doc/changelogs/CHANGELOG_V25.md#25.6.1">25.6.1</a><br/>
48-
<a href="doc/changelogs/CHANGELOG_V25.md#25.6.0">25.6.0</a><br/>
49-
<a href="doc/changelogs/CHANGELOG_V25.md#25.5.0">25.5.0</a><br/>
50-
<a href="doc/changelogs/CHANGELOG_V25.md#25.4.0">25.4.0</a><br/>
51-
<a href="doc/changelogs/CHANGELOG_V25.md#25.3.0">25.3.0</a><br/>
52-
<a href="doc/changelogs/CHANGELOG_V25.md#25.2.1">25.2.1</a><br/>
53-
<a href="doc/changelogs/CHANGELOG_V25.md#25.2.0">25.2.0</a><br/>
54-
<a href="doc/changelogs/CHANGELOG_V25.md#25.1.0">25.1.0</a><br/>
55-
<a href="doc/changelogs/CHANGELOG_V25.md#25.0.0">25.0.0</a><br/>
56-
</td>
57-
<td valign="top">
58-
<b><a href="doc/changelogs/CHANGELOG_V24.md#24.14.0">24.14.0</a></b><br/>
59-
<a href="doc/changelogs/CHANGELOG_V24.md#24.13.1">24.13.1</a><br/>
60-
<a href="doc/changelogs/CHANGELOG_V24.md#24.13.0">24.13.0</a><br/>
61-
<a href="doc/changelogs/CHANGELOG_V24.md#24.12.0">24.12.0</a><br/>
62-
<a href="doc/changelogs/CHANGELOG_V24.md#24.11.1">24.11.1</a><br/>
63-
<a href="doc/changelogs/CHANGELOG_V24.md#24.11.0">24.11.0</a><br/>
64-
<a href="doc/changelogs/CHANGELOG_V24.md#24.10.0">24.10.0</a><br/>
65-
<a href="doc/changelogs/CHANGELOG_V24.md#24.9.0">24.9.0</a><br/>
66-
<a href="doc/changelogs/CHANGELOG_V24.md#24.8.0">24.8.0</a><br/>
67-
<a href="doc/changelogs/CHANGELOG_V24.md#24.7.0">24.7.0</a><br/>
68-
<a href="doc/changelogs/CHANGELOG_V24.md#24.6.0">24.6.0</a><br/>
69-
<a href="doc/changelogs/CHANGELOG_V24.md#24.5.0">24.5.0</a><br/>
70-
<a href="doc/changelogs/CHANGELOG_V24.md#24.4.1">24.4.1</a><br/>
71-
<a href="doc/changelogs/CHANGELOG_V24.md#24.4.0">24.4.0</a><br/>
72-
<a href="doc/changelogs/CHANGELOG_V24.md#24.3.0">24.3.0</a><br/>
73-
<a href="doc/changelogs/CHANGELOG_V24.md#24.2.0">24.2.0</a><br/>
74-
<a href="doc/changelogs/CHANGELOG_V24.md#24.1.0">24.1.0</a><br/>
75-
<a href="doc/changelogs/CHANGELOG_V24.md#24.0.2">24.0.2</a><br/>
76-
<a href="doc/changelogs/CHANGELOG_V24.md#24.0.1">24.0.1</a><br/>
77-
<a href="doc/changelogs/CHANGELOG_V24.md#24.0.0">24.0.0</a><br/>
78-
</td>
79-
<td valign="top">
80-
<b><a href="doc/changelogs/CHANGELOG_V22.md#22.22.1">22.22.1</a></b><br/>
44+
<b><a href="doc/changelogs/CHANGELOG_V22.md#22.22.2">22.22.2</a></b><br/>
45+
<a href="doc/changelogs/CHANGELOG_V22.md#22.22.1">22.22.1</a><br/>
8146
<a href="doc/changelogs/CHANGELOG_V22.md#22.22.0">22.22.0</a><br/>
8247
<a href="doc/changelogs/CHANGELOG_V22.md#22.21.1">22.21.1</a><br/>
8348
<a href="doc/changelogs/CHANGELOG_V22.md#22.21.0">22.21.0</a><br/>

‎doc/changelogs/CHANGELOG_V22.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
</tr>
1010
<tr>
1111
<td>
12+
<a href="#22.22.2">22.22.2</a><br/>
1213
<a href="#22.22.1">22.22.1</a><br/>
1314
<a href="#22.22.0">22.22.0</a><br/>
1415
<a href="#22.21.1">22.21.1</a><br/>
@@ -72,6 +73,41 @@
7273
* [io.js](CHANGELOG_IOJS.md)
7374
* [Archive](CHANGELOG_ARCHIVE.md)
7475

76+
<a id="22.22.2"></a>
77+
78+
## 2026-03-24, Version 22.22.2 'Jod' (LTS), @RafaelGSS prepared by @aduh95
79+
80+
This is a security release.
81+
82+
### Notable Changes
83+
84+
* (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High
85+
* (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High
86+
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
87+
* (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium
88+
* (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
89+
* (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low
90+
* (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low
91+
92+
### Commits
93+
94+
* \[[`6f14ee5101`](https://github.com/nodejs/node/commit/6f14ee5101)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
95+
* \[[`52a52ef619`](https://github.com/nodejs/node/commit/52a52ef619)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
96+
* \[[`30a3ab11e2`](https://github.com/nodejs/node/commit/30a3ab11e2)] - **(CVE-2026-21717)** **deps**: V8: cherry-pick aac14dd95e5b (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
97+
* \[[`e3f4d6a42e`](https://github.com/nodejs/node/commit/e3f4d6a42e)] - **(CVE-2026-21717)** **deps**: V8: backport 1361b2a49d02 (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
98+
* \[[`7dc00fa5f4`](https://github.com/nodejs/node/commit/7dc00fa5f4)] - **(CVE-2026-21717)** **deps**: V8: backport 185f0fe09b72 (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
99+
* \[[`076acd052d`](https://github.com/nodejs/node/commit/076acd052d)] - **(CVE-2026-21717)** **deps**: V8: backport 0a8b1cdcc8b2 (snek) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
100+
* \[[`963c60a951`](https://github.com/nodejs/node/commit/963c60a951)] - **deps**: V8: override `depot_tools` version (Richard Lau) [#62344](https://github.com/nodejs/node/pull/62344)
101+
* \[[`a688117d5d`](https://github.com/nodejs/node/commit/a688117d5d)] - **deps**: upgrade npm to 10.9.7 (npm team) [#62330](https://github.com/nodejs/node/pull/62330)
102+
* \[[`859c8c761b`](https://github.com/nodejs/node/commit/859c8c761b)] - **deps**: update undici to v6.24.1 (Matteo Collina) [#62285](https://github.com/nodejs/node/pull/62285)
103+
* \[[`d5ed384a2f`](https://github.com/nodejs/node/commit/d5ed384a2f)] - **deps**: upgrade npm to 10.9.6 (npm team) [#62215](https://github.com/nodejs/node/pull/62215)
104+
* \[[`a2fe9fd81a`](https://github.com/nodejs/node/commit/a2fe9fd81a)] - **(CVE-2026-21710)** **http**: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) [nodejs-private/node-private#821](https://github.com/nodejs-private/node-private/pull/821)
105+
* \[[`73deff77c1`](https://github.com/nodejs/node/commit/73deff77c1)] - **lib**: backport `_tls_common` and `_tls_wrap` refactors (Dario Piotrowicz) [#57643](https://github.com/nodejs/node/pull/57643)
106+
* \[[`06fc3436f6`](https://github.com/nodejs/node/commit/06fc3436f6)] - **(CVE-2026-21716)** **permission**: include permission check on lib/fs/promises (RafaelGSS) [nodejs-private/node-private#795](https://github.com/nodejs-private/node-private/pull/795)
107+
* \[[`db48d9c675`](https://github.com/nodejs/node/commit/db48d9c675)] - **(CVE-2026-21715)** **permission**: add permission check to realpath.native (RafaelGSS) [nodejs-private/node-private#794](https://github.com/nodejs-private/node-private/pull/794)
108+
* \[[`2a6105a63b`](https://github.com/nodejs/node/commit/2a6105a63b)] - **(CVE-2026-21714)** **src**: handle NGHTTP2\_ERR\_FLOW\_CONTROL error code (RafaelGSS) [nodejs-private/node-private#832](https://github.com/nodejs-private/node-private/pull/832)
109+
* \[[`91b970886f`](https://github.com/nodejs/node/commit/91b970886f)] - **(CVE-2026-21637)** **tls**: wrap SNICallback invocation in try/catch (Matteo Collina) [nodejs-private/node-private#819](https://github.com/nodejs-private/node-private/pull/819)
110+
75111
<a id="22.22.1"></a>
76112

77113
## 2026-03-05, Version 22.22.1 'Jod' (LTS), @marco-ippolito prepared by @aduh95

0 commit comments

Comments
 (0)