UnratedFix available
Node.js 26.3.1 (Current)
Node.js 26.3.1 is a security release that fixes multiple security issues, including TLS identity-check, WebCrypto, HTTP/2, DNS, and permission-model issues.
Announced Source revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release.
Node.js
Node.js 26.3.1 (Current)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 26.3.1
Version 26.3.1 (Current)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2026-48618
(CVE-2026-48618) tls: normalize hostname for server identity checks
CVE-2026-48933(CVE-2026-48933) crypto: guard WebCrypto cipher output length
CVE-2026-48615(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors
CVE-2026-48619(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth
CVE-2026-48928(CVE-2026-48928) tls: fix case-sensitive SNI context matching
CVE-2026-48930(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes
CVE-2026-48934(CVE-2026-48934) tls: bind reusable sessions to authenticated host
CVE-2026-48617(CVE-2026-48617) permission: handle process.chdir on writereport
CVE-2026-48931(CVE-2026-48931) http: fix response queue poisoning in http.Agent
CVE-2026-48935(CVE-2026-48935) permission: disable FileHandle utimes with permission model
CVE-2026-48936(CVE-2026-48936) permission: guard pipe open and chmod with net scope
Publisher severity
No explicit severity was extracted.
- Event
- #19332 · Revision 1
- Added to Heist Feed
- Publisher date