UnratedFix available
Node.js 22.23.2 (LTS)
Node.js 22.23.2 is a security release fixing multiple issues across HTTP/2, permissions, HTTPS, DNS, zlib, and HTTP. The announcement labels the fixes High, Medium, and Low.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release. Notable Changes
Node.js
Node.js 22.23.2 (LTS)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 22.23.2
Version 22.23.2 'Jod' (LTS)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2026-56846
(CVE-2026-56846) http2: retain header memory in session accounting
CVE-2026-56848(CVE-2026-56848) http2: defer rst stream while in scope
CVE-2026-58043(CVE-2026-58043) permission: avoid granting radix split nodes
CVE-2026-56850(CVE-2026-56850) https: distinguish PFX object-array agent keys
CVE-2026-58040(CVE-2026-58040) https: bind identity checks to session reuse
CVE-2026-58042(CVE-2026-58042) dns: handle large resolveAny address replies
CVE-2026-58045(CVE-2026-58045) zlib: throw on out-of-bounds write buffers
CVE-2026-56847(CVE-2026-56847) permission: enforce fs write permission for trace events
CVE-2026-58039(CVE-2026-58039) permission: check final report output path
CVE-2026-58044(CVE-2026-58044) http: reject requests exceeding max header count
Publisher severity
No explicit severity was extracted.
- Event
- #19329 · Revision 1
- Added to Heist Feed
- Publisher date