UnratedFix available
Node.js 24.17.0 (LTS) security release
Node.js 24.17.0 (LTS) is a security release fixing multiple security issues, including issues rated High, Medium, and Low.
Announced Source revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release.
Node.js
Node.js 24.17.0 (LTS)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 24.17.0
Version 24.17.0 'Krypton' (LTS)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2026-48618
(CVE-2026-48618) tls: normalize hostname for server identity checks
CVE-2026-48933(CVE-2026-48933) crypto: guard WebCrypto cipher output length
CVE-2026-48615(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors
CVE-2026-48619(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth
CVE-2026-48928(CVE-2026-48928) tls: fix case-sensitive SNI context matching
CVE-2026-48930(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes
CVE-2026-48934(CVE-2026-48934) tls: bind reusable sessions to authenticated host
CVE-2026-48937(CVE-2026-48937) deps: fix integration issues with the latest nghttp2
CVE-2026-48617(CVE-2026-48617) permission: handle process.chdir on writereport
CVE-2026-48931(CVE-2026-48931) http: fix response queue poisoning in http.Agent
CVE-2026-48935(CVE-2026-48935) permission: disable FileHandle utimes with permission model
Publisher severity
No explicit severity was extracted.
- Event
- #19331 · Revision 1
- Added to Heist Feed
- Publisher date