Skip to content
Heist/ feed
UnratedFix available

Node.js 20.20.2 (LTS)

Type: patchSource: Node.js announcements1 source record

Node.js 20.20.2 is a security release fixing multiple issues, including array index hash collision, timing-safe comparison, permission checks, and TLS callback handling.

Announced Source revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.20.2 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
20.20.2
Version 20.20.2 'Iron' (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2026-21717
(CVE-2026-21717) fix array index hash collision
CVE-2026-21713
(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC
CVE-2026-21710
(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
CVE-2026-21716
(CVE-2026-21716) include permission check on lib/fs/promises
CVE-2026-21715
(CVE-2026-21715) add permission check to realpath.native
CVE-2026-21714
(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
CVE-2026-21637
(CVE-2026-21637) wrap SNICallback invocation in try/catch

Publisher severity

No explicit severity was extracted.

Event
#19339 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement