Node.js 24.17.0 (LTS)

Antoine du Hamel

2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95

This is a security release.

Notable Changes

(CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
(CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
(CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
(CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
(CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
(CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
(CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
(CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

[9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
[cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
[a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891
[66e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891
[dd627ced27] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820
[684bae568f] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820
[3a631e7f83] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656
[cf44df3996] - deps: update undici to 7.28.0 (Node.js GitHub Bot) #63703
[138c70294b] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
[be7e719c3f] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
[cc7c11b4d1] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
[9224427b92] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
[cf85d54839] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
[a1bbc24f96] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
[e3723ff2d6] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
[a77af4867b] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
[31beb4f707] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
[8e75c73f91] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

31e9fc249c74a3a6dfeca4758229f003620459b42c3749f7c423f2999d09a727  node-v24.17.0-aix-ppc64.tar.gz
adee7826d2840efd66cec5e79c9b4e151f4815ac0e24f92cf334bc28d7f1f83c  node-v24.17.0-arm64.msi
4fc3266a3702eebc39cc37661cf4eeceeade307e242ab64e4d7ce7949197e11f  node-v24.17.0-darwin-arm64.tar.gz
cf7e9152d7bd86c140f6eccf3577abfbaf8960be1ca49d9d900e8484984dcb9a  node-v24.17.0-darwin-arm64.tar.xz
80da552fe037290cb130e9dea590f5eeeb7aa450636f0c89ab41415511c1ec27  node-v24.17.0-darwin-x64.tar.gz
fe50e386f6a5e0b29ce44b989e543da9fb9a80aed0b91a2f0cb19c55106921fc  node-v24.17.0-darwin-x64.tar.xz
ac60c4ba92204658efaac112efea5d3597348b011be679af0eec324d8c08915e  node-v24.17.0-headers.tar.gz
aab64d32cd1690e4027326e746877bdac62f0a8458215241638477cbfe0a4192  node-v24.17.0-headers.tar.xz
faa0d59ba7fe7045c950ed09b190578fb8eee73e4358686d38fcc99ca58c1480  node-v24.17.0-linux-arm64.tar.gz
67324b9e515e7d13da72571a5dd522bb23145a820f7dde15497897e466759ab3  node-v24.17.0-linux-arm64.tar.xz
804ed4a1a0ef28d592408b84ac2a85e858ab9124dad933e12b4323609411b809  node-v24.17.0-linux-ppc64le.tar.gz
7657dfb803132a05cfc83353f43f603cba790e1d2366caeb36083aa8f351124b  node-v24.17.0-linux-ppc64le.tar.xz
a659e9c26fcd648f3359dbfd292f078434168040f2fb1acf3c9c1bcd3fc37b2b  node-v24.17.0-linux-s390x.tar.gz
a8e6f79fac2e17e5a9a9d479bad3b6f19921049bbb5888fa238347427502f23c  node-v24.17.0-linux-s390x.tar.xz
e0472427aa791ad80bdc426ff7cc73cdd28ed0f616d1ff9689a23a7f47f1265f  node-v24.17.0-linux-x64.tar.gz
ab343a1b747c7cbf3630dfd7dbf818c5423fab2eb4f5ad1afc896f6bd121a917  node-v24.17.0-linux-x64.tar.xz
0ef6a68334882bb74f5afd2d370cf2cdabc3ef823c8fdd649d9d779478c09607  node-v24.17.0-win-arm64.7z
4957712f67fce55779cc794d9b4df9e0e802a18c841ad5a4e42f17be490e634d  node-v24.17.0-win-arm64.zip
91382ab13fea6cfdd475fc0f5b74727c979f609a94905ae338f8b9f1cce32457  node-v24.17.0-win-x64.7z
f2aa33b35b75aca5f3f7b85675a6f6423201053e9381911e64961f3bda2528ab  node-v24.17.0-win-x64.zip
ae5d9e9f6c85b8d35717f499ba907259ec80672c289858bae19074355906a240  node-v24.17.0-x64.msi
6d795ec7986972ac377bcf017eb2a4f970962f36e1584bfebe79326a194f365f  node-v24.17.0.pkg
66a10e05fa7875ff1d7d669de405ea6ce8725f2352bd07550f520dea2f880825  node-v24.17.0.tar.gz
a7ab562ed2369a29c68b72fa00e3103bcdfe37063dff799c6acc8e404e275fcd  node-v24.17.0.tar.xz
44999f9ec6486d01202d8961f343eac8c9f2847b234a8637c3fd0f1e2bb3288a  win-arm64/node.exe
d32c3ff35f34b9593e5fcddc23ca779f4b40abfb9aa5a031d620f1ecb44ca935  win-arm64/node.lib
60c69df69e22db238ab670efb7ad57ab6da92adcea33c6eea152daf3c2182ad6  win-arm64/node_pdb.7z
93262aebc5c28f3f2218cad37a7635b9fb95ea89cb068c124b7eac9446682029  win-arm64/node_pdb.zip
c6335d08331c23d68b9f2b18adb102002d76ef150b47248e954c507e0d033664  win-x64/node.exe
4ab42af597bc4f0957e9e2dcd5db18bdf223406a0c8e0b6be0f28e57977b808b  win-x64/node.lib
0e2a2937823b7fbca4d4ed344ed13d6c8a519d06460f77966fce59e1d146826b  win-x64/node_pdb.7z
bd231782ef5e062395d6d2a259c3aaee994db694df9bdcd4beeb9d6bac9e69ec  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCajN1TwAKCRAgsaOQsWjT
VsDcAQClE4tL8dBeOyi941MK78i7o4iOFfoYYdyIayxQww7nTgD/Zmdx1h1gjwo/
J5fumRrmsNRDj6JYjUfEzKSSJjFX7Q8=
=nnSg
-----END PGP SIGNATURE-----

Node.js 26.3.1 (Current)Node.js 22.23.0 (LTS)