CVE-2026-48618" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-g57m-hr98-5m89/hovercard" href="https://github.com/advisories/GHSA-g57m-hr98-5m89">CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Uh oh!

Commits

Commits on Jun 22, 2026

node: bump to 22.23.0