Node 26.12.1 has been released, designated as a security update.
Key security enhancements include (CVE-2026-106069, CVE-2026-106072) in the tls module, which now rejects non-canonical IP addresses, implemented by Matteo Collina, rated High.
Furthermore, James M Snell addressed High-severity issues, specifically (CVE-2026-105482) by validating resolve inputs for null bytes in dns, and (CVE-2026-105483) to correct an ip normalization regression in tls.
Other notable fixes involve (CVE-2026-111497) in src, exposing `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` by Antoine du Hamel, and a related dependency update for brotli (CVE-2026-111497) by Evgenii Kliuchnikov.
The release also contains medium-severity patches, such as (CVE-2026-105481) ensuring agent data guard functions without I/O, and (CVE-2026-106074) resetting random caches across snapshots, contributed by Filip Skokan.
Node 24.22.1, also a security release, incorporates fixes for similar vulnerabilities, including (CVE-2026-105482) and (CVE-2026-105483).
This version updates several dependencies, including c-ares to 1.34.9 by the Node.js GitHub Bot, and upgrades openssl sources to openssl-3.5.9 via the Node.js GitHub Bot.
Node 22.23.4, another security release, includes dependency updates such as sqlite to 3.53.4 by the Node.js GitHub Bot, and undici to 6.29.1 by the Node.js GitHub Bot.
These updates reflect ongoing efforts by platform maintainers to harden core infrastructure components against various low-level exploits across the ecosystem.
