feat(blog): create post for v22.22.2 (#8773)

Co-authored-by: Create or Update Pull Request Action <create-or-update-pull-request@users.noreply.github.com>

Author: github-actions[bot]

apps/site/pages/en/blog/release/v22.22.2.md

@@ -0,0 +1,122 @@
+---
+date: '2026-03-24T20:43:26.981Z'
+category: release
+title: Node.js 22.22.2 (LTS)
+layout: blog-post
+author: Rafael Gonzaga
+---
+
+## 2026-03-24, Version 22.22.2 'Jod' (LTS), @RafaelGSS prepared by @aduh95
+
+This is a security release.
+
+### Notable Changes
+
+- (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High
+- (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High
+- (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
+- (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium
+- (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
+- (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low
+- (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low
+
+### Commits
+
+- \[[`6f14ee5101`](https://github.com/nodejs/node/commit/6f14ee5101)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
+- \[[`52a52ef619`](https://github.com/nodejs/node/commit/52a52ef619)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
+- \[[`30a3ab11e2`](https://github.com/nodejs/node/commit/30a3ab11e2)] - **(CVE-2026-21717)** **deps**: V8: cherry-pick aac14dd95e5b (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
+- \[[`e3f4d6a42e`](https://github.com/nodejs/node/commit/e3f4d6a42e)] - **(CVE-2026-21717)** **deps**: V8: backport 1361b2a49d02 (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
+- \[[`7dc00fa5f4`](https://github.com/nodejs/node/commit/7dc00fa5f4)] - **(CVE-2026-21717)** **deps**: V8: backport 185f0fe09b72 (Joyee Cheung) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
+- \[[`076acd052d`](https://github.com/nodejs/node/commit/076acd052d)] - **(CVE-2026-21717)** **deps**: V8: backport 0a8b1cdcc8b2 (snek) [nodejs-private/node-private#809](https://github.com/nodejs-private/node-private/pull/809)
+- \[[`963c60a951`](https://github.com/nodejs/node/commit/963c60a951)] - **deps**: V8: override `depot_tools` version (Richard Lau) [#62344](https://github.com/nodejs/node/pull/62344)
+- \[[`a688117d5d`](https://github.com/nodejs/node/commit/a688117d5d)] - **deps**: upgrade npm to 10.9.7 (npm team) [#62330](https://github.com/nodejs/node/pull/62330)
+- \[[`859c8c761b`](https://github.com/nodejs/node/commit/859c8c761b)] - **deps**: update undici to v6.24.1 (Matteo Collina) [#62285](https://github.com/nodejs/node/pull/62285)
+- \[[`d5ed384a2f`](https://github.com/nodejs/node/commit/d5ed384a2f)] - **deps**: upgrade npm to 10.9.6 (npm team) [#62215](https://github.com/nodejs/node/pull/62215)
+- \[[`a2fe9fd81a`](https://github.com/nodejs/node/commit/a2fe9fd81a)] - **(CVE-2026-21710)** **http**: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) [nodejs-private/node-private#821](https://github.com/nodejs-private/node-private/pull/821)
+- \[[`73deff77c1`](https://github.com/nodejs/node/commit/73deff77c1)] - **lib**: backport `_tls_common` and `_tls_wrap` refactors (Dario Piotrowicz) [#57643](https://github.com/nodejs/node/pull/57643)
+- \[[`06fc3436f6`](https://github.com/nodejs/node/commit/06fc3436f6)] - **(CVE-2026-21716)** **permission**: include permission check on lib/fs/promises (RafaelGSS) [nodejs-private/node-private#795](https://github.com/nodejs-private/node-private/pull/795)
+- \[[`db48d9c675`](https://github.com/nodejs/node/commit/db48d9c675)] - **(CVE-2026-21715)** **permission**: add permission check to realpath.native (RafaelGSS) [nodejs-private/node-private#794](https://github.com/nodejs-private/node-private/pull/794)
+- \[[`2a6105a63b`](https://github.com/nodejs/node/commit/2a6105a63b)] - **(CVE-2026-21714)** **src**: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) [nodejs-private/node-private#832](https://github.com/nodejs-private/node-private/pull/832)
+- \[[`91b970886f`](https://github.com/nodejs/node/commit/91b970886f)] - **(CVE-2026-21637)** **tls**: wrap SNICallback invocation in try/catch (Matteo Collina) [nodejs-private/node-private#819](https://github.com/nodejs-private/node-private/pull/819)
+
+Windows 32-bit Installer: https://nodejs.org/dist/v22.22.2/node-v22.22.2-x86.msi \
+Windows 64-bit Installer: https://nodejs.org/dist/v22.22.2/node-v22.22.2-x64.msi \
+Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.22.2/node-v22.22.2-arm64.msi \
+Windows 32-bit Binary: https://nodejs.org/dist/v22.22.2/win-x86/node.exe \
+Windows 64-bit Binary: https://nodejs.org/dist/v22.22.2/win-x64/node.exe \
+Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.22.2/win-arm64/node.exe \
+macOS 64-bit Installer: https://nodejs.org/dist/v22.22.2/node-v22.22.2.pkg \
+macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-darwin-arm64.tar.gz \
+macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-darwin-x64.tar.gz \
+Linux 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-x64.tar.xz \
+Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-ppc64le.tar.xz \
+Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-s390x.tar.xz \
+AIX 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-aix-ppc64.tar.gz \
+ARMv7 32-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-armv7l.tar.xz \
+ARMv8 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-arm64.tar.xz \
+Source Code: https://nodejs.org/dist/v22.22.2/node-v22.22.2.tar.gz \
+Other release files: https://nodejs.org/dist/v22.22.2/ \
+Documentation: https://nodejs.org/docs/v22.22.2/api/
+
+### SHASUMS
+
+```
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+31e8cdaf9921589c2978fd224aa5ae51e470577df63435ebfff16b715ed8d4d3  node-v22.22.2-aix-ppc64.tar.gz
+1ec02aeb76d716ce15915bed10c0a4dcf9a6224e9a4f4d1645ddca4985a7bc06  node-v22.22.2-arm64.msi
+db4b275b83736df67533529a18cc55de2549a8329ace6c7bcc68f8d22d3c9000  node-v22.22.2-darwin-arm64.tar.gz
+f8655beb4b86ff6588ed7e02c37f8574b58557bd3e880012814b1a4956fd9d88  node-v22.22.2-darwin-arm64.tar.xz
+12a6abb9c2902cf48a21120da13f87fde1ed1b71a13330712949e8db818708ba  node-v22.22.2-darwin-x64.tar.gz
+b6a384bba1a7ec585e5a91a452b63f676b940584ff57b5c9cf0541c8db60023e  node-v22.22.2-darwin-x64.tar.xz
+90e5ef0fdf02f88487f904a798836b35bd44896046d502873bc625ac2baeded2  node-v22.22.2-headers.tar.gz
+b4dde76c01769ae141de9228cc47dd53853cde2fd94f7d40192273ec79dd405b  node-v22.22.2-headers.tar.xz
+b2f3a96f31486bfc365192ad65ced14833ad2a3c2e1bcefec4846902f264fa28  node-v22.22.2-linux-arm64.tar.gz
+e9e1930fd321a470e29bb68f30318bf58e3ecb4acb4f1533fb19c58328a091fe  node-v22.22.2-linux-arm64.tar.xz
+465162c9e1821b2168b2740351ae8f191b24b58313f0cf9873a7ccd200a66e12  node-v22.22.2-linux-armv7l.tar.gz
+2ebc6746e517f345da340ec76a108203eb6c2365391eb525c0e0dd6135b0b9df  node-v22.22.2-linux-armv7l.tar.xz
+f661dd525231faf113bd484129169d222b84ef40c091b5dca04a104d43e25d07  node-v22.22.2-linux-ppc64le.tar.gz
+14045b5a5030d35ca0030fb7e870bd11a651eb9b57323ebc0021e8d78ac6bac9  node-v22.22.2-linux-ppc64le.tar.xz
+4c28684a4c75683c491464f7fa168cd37752ed343fc27fb85b75806517e340cb  node-v22.22.2-linux-s390x.tar.gz
+9e4a07c291b8949289c6ea8ee61b1d14666a4810feae776a8d1eb1f57e03a2fb  node-v22.22.2-linux-s390x.tar.xz
+978978a635eef872fa68beae09f0aad0bbbae6757e444da80b570964a97e62a3  node-v22.22.2-linux-x64.tar.gz
+88fd1ce767091fd8d4a99fdb2356e98c819f93f3b1f8663853a2dee9b438068a  node-v22.22.2-linux-x64.tar.xz
+ed1b73ffb642978e669786f9115d2579e890a3f9bf3dcd7c73272047b4895a17  node-v22.22.2-win-arm64.7z
+380d375cf650c5a7f2ef3ce29ac6ea9a1c9d2ec8ea8e8391e1a34fd543886ab3  node-v22.22.2-win-arm64.zip
+c87622c838f312d1fcc635e09034013e983ebe8df039a62ab46c22b34b9b8a0c  node-v22.22.2-win-x64.7z
+7c93e9d92bf68c07182b471aa187e35ee6cd08ef0f24ab060dfff605fcc1c57c  node-v22.22.2-win-x64.zip
+d73718f162d286d1deaf911d8bf224ba823a877cd0ed23c0d09b43923f6bd699  node-v22.22.2-win-x86.7z
+ca892f829a733109e341c43585fd2094177e9d2f2c45f97c7ed3cf329d5427c5  node-v22.22.2-win-x86.zip
+57456aa33fcd6fb6a9418e09227de0b0ca604f7b2123566acc66b555cb2f42e5  node-v22.22.2-x64.msi
+e43cf42f461cbfea23a079925cfdd132a18cf66d4e30f64ec5ab4ec31dbb41f3  node-v22.22.2-x86.msi
+ff08ad19678de4ca2af34b58b73b272c555449c6f2d91487ca6fe0a697f9eabe  node-v22.22.2.pkg
+f4b9606f33aef725a77b6292460102b48b80902571a8bb94cd769837ee0577df  node-v22.22.2.tar.gz
+b6bedd3a8cacd5df7df015a5088264b12c74a277ba60684cb9642ae8eb743132  node-v22.22.2.tar.xz
+1a338f2467a566197ed8b309240a3a372f5d72458f9c7e5c9613ad6ccae1e0c0  win-arm64/node.exe
+9b75bbc3be72c84f1d41cd6abb6e5ecc333836015e40a6267ce755554874a13a  win-arm64/node.lib
+d8439627dd1081c37267c77a79cf7f21c0a7cfd85c582fc3d6361d4b6a720388  win-arm64/node_pdb.7z
+76a309aae5afd000b87359a4d26c2392dfc231ef626c1a77ec103452677edad4  win-arm64/node_pdb.zip
+ae1a50511be58e987483fdbc12125407443926d2d394669ade2352776e920dd3  win-x64/node.exe
+0d8d8bcc11daea60f5dd4da414e72ccb785718345ec8fbec52cfc7d1a2326293  win-x64/node.lib
+0431a2383c9ceec6bd46d5d96fec1342c0adf7bd57528312fe4812e32e1d2e5c  win-x64/node_pdb.7z
+7a5071732adc414638f4a8e06926820410dfd6421badbe0221dfa594ec2a766f  win-x64/node_pdb.zip
+ed2aff66c21ea111e517b3c8a6857c35d222cc83e12ff66d9c03b61e2e0558e7  win-x86/node.exe
+a07e94777fb491c1a59103b6987417df35a1dd0a9682220bba43d3c602b8b414  win-x86/node.lib
+0f43bd6b98aa25bc7067cf374de59ec853035778ff4b6ce2fb118dc67f5eaee9  win-x86/node_pdb.7z
+ffd472e223a8dbde11867016e51744dadb3e55af8dc3d663fb605a1560a63017  win-x86/node_pdb.zip
+-----BEGIN PGP SIGNATURE-----
+
+iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmnC9gcACgkQi+q0389V
+XvR1ugwAiiv5SVNLVMJa5ww1CtXHbVX7Kd1vGXw9INsK1iIUrwT4T2lZa+KnztYx
+ngwaxIa8h4/x9IS262tRYJUHqcQtRP+J8pD7ahnf+JW5BZN9HQ+C1jEy6TWrH5rt
+zQfFUYrRM7jbWPXlDmFecBPpOC48mZyOe8I7UzDjQGY1KYx6HHutUi28bAbPxzi+
+CzcpgsdhD/y/qhQW/DtlmFj4AWh1oFzZZW3C0mNRNgC96FVs61Xp4CXfiPO9vFwY
+VjB2JHYkxVx2K1m5O4CcrtEEtg7LBpuzCNke/INnKXdh4UDqSBGXm/oAvl71VLgH
+aICjDIKcS4TXmWmaSbPN4y6Lfe30a8CESRolX/5nvzAyQy/pVmmhyi1l15IzAQDu
+b/efW5bZn7wJTcNJz64vqXNPE1eKfJES7cAabDkvxnAWQhf9JtZf406QH5c+Ygig
+Yo/97a00Pv6/nBJLF4woxYBjG5/2hKxuhkOKQ9QnDqCXW0ACpWHn1aX+Stv5s6Ps
+JNKkGS1v
+=uiHn
+-----END PGP SIGNATURE-----
+```