Skip to content

Commit bc2e01d

Browse files
RafaelGSSaduh95
RafaelGSS
authored and
aduh95
committed
2026-10-21, Version 26.12.1 (Current)
This is a security release. Notable changes: * (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High * (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High * (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High * (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) – High * (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High * (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium * (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium * (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low * (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low * (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low * deps: V8: backport 93cd21e8254b (Joyee Cheung) * crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) * tls: reject chains containing blocked public keys (Ulises Gascon) * deps: update c-ares to 1.34.9 (Node.js GitHub Bot) * tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) * crypto: harden X.509 conversion and formatting (Filip Skokan) PR-URL: nodejs-private/node-private#1013
1 parent 7895a5c commit bc2e01d

3 files changed

Lines changed: 50 additions & 2 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@ release.
4141
</tr>
4242
<tr>
4343
<td valign="top">
44-
<b><a href="doc/changelogs/CHANGELOG_V26.md#26.12.0">26.12.0</a></b><br/>
44+
<b><a href="doc/changelogs/CHANGELOG_V26.md#26.12.1">26.12.1</a></b><br/>
45+
<a href="doc/changelogs/CHANGELOG_V26.md#26.12.0">26.12.0</a><br/>
4546
<a href="doc/changelogs/CHANGELOG_V26.md#26.11.1">26.11.1</a><br/>
4647
<a href="doc/changelogs/CHANGELOG_V26.md#26.11.0">26.11.0</a><br/>
4748
<a href="doc/changelogs/CHANGELOG_V26.md#26.10.0">26.10.0</a><br/>

‎doc/changelogs/CHANGELOG_V26.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
</tr>
99
<tr>
1010
<td>
11+
<a href="#26.12.1">26.12.1</a><br/>
1112
<a href="#26.12.0">26.12.0</a><br/>
1213
<a href="#26.11.1">26.11.1</a><br/>
1314
<a href="#26.11.0">26.11.0</a><br/>
@@ -58,6 +59,52 @@
5859
* [io.js](CHANGELOG_IOJS.md)
5960
* [Archive](CHANGELOG_ARCHIVE.md)
6061

62+
<a id="26.12.1"></a>
63+
64+
## 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS
65+
66+
This is a security release.
67+
68+
### Notable Changes
69+
70+
* (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
71+
* (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
72+
* (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
73+
* (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) – High
74+
* (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
75+
* (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
76+
* (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
77+
* (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
78+
* (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
79+
* (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
80+
* deps: V8: backport 93cd21e8254b (Joyee Cheung)
81+
* crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
82+
* tls: reject chains containing blocked public keys (Ulises Gascon)
83+
* deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
84+
* tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
85+
* crypto: harden X.509 conversion and formatting (Filip Skokan)
86+
87+
### Commits
88+
89+
* \[[`818e4ca061`](https://github.com/nodejs/node/commit/818e4ca061)] - **crypto**: update root certificates to NSS 3.131.1 (Antoine du Hamel) [#66877](https://github.com/nodejs/node/pull/66877)
90+
* \[[`fd3c87ed43`](https://github.com/nodejs/node/commit/fd3c87ed43)] - **crypto**: harden X.509 conversion and formatting (Filip Skokan) [nodejs-private/node-private#966](https://github.com/nodejs-private/node-private/pull/966)
91+
* \[[`acffa610db`](https://github.com/nodejs/node/commit/acffa610db)] - **crypto**: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-private/node-private/pull/987)
92+
* \[[`7895a5cd2d`](https://github.com/nodejs/node/commit/7895a5cd2d)] - **deps**: update undici to 8.12.2 (Node.js GitHub Bot) [#66721](https://github.com/nodejs/node/pull/66721)
93+
* \[[`12daa54d2e`](https://github.com/nodejs/node/commit/12daa54d2e)] - **deps**: V8: backport 93cd21e8254b (Joyee Cheung) [nodejs-private/node-private#999](https://github.com/nodejs-private/node-private/pull/999)
94+
* \[[`6a8b3db7e2`](https://github.com/nodejs/node/commit/6a8b3db7e2)] - **deps**: update c-ares to 1.34.9 (Node.js GitHub Bot) [#66868](https://github.com/nodejs/node/pull/66868)
95+
* \[[`a6040b50d9`](https://github.com/nodejs/node/commit/a6040b50d9)] - **deps**: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002)
96+
* \[[`6b78ea171d`](https://github.com/nodejs/node/commit/6b78ea171d)] - **dns**: validate resolve inputs for null bytes (James M Snell) [nodejs-private/node-private#984](https://github.com/nodejs-private/node-private/pull/984)
97+
* \[[`0683ee5f7d`](https://github.com/nodejs/node/commit/0683ee5f7d)] - **http**: ensure agent data guard works without I/O (James M Snell) [nodejs-private/node-private#983](https://github.com/nodejs-private/node-private/pull/983)
98+
* \[[`e5cae10148`](https://github.com/nodejs/node/commit/e5cae10148)] - _**Revert**_ "**module**: synchronously load most ES modules" (Antoine du Hamel) [#66786](https://github.com/nodejs/node/pull/66786)
99+
* \[[`cc244131aa`](https://github.com/nodejs/node/commit/cc244131aa)] - **permission**: check permission model in realpathSync (RafaelGSS) [nodejs-private/node-private#973](https://github.com/nodejs-private/node-private/pull/973)
100+
* \[[`0392385841`](https://github.com/nodejs/node/commit/0392385841)] - **src**: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002)
101+
* \[[`c273a408c9`](https://github.com/nodejs/node/commit/c273a408c9)] - **src**: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/pull/986)
102+
* \[[`a2caddd20e`](https://github.com/nodejs/node/commit/a2caddd20e)] - **tls**: reject chains containing blocked public keys (Ulises Gascon) [#66871](https://github.com/nodejs/node/pull/66871)
103+
* \[[`ad788ccd07`](https://github.com/nodejs/node/commit/ad788ccd07)] - **tls**: reject non-canonical IP addresses (Matteo Collina) [nodejs-private/node-private#982](https://github.com/nodejs-private/node-private/pull/982)
104+
* \[[`cd4b05469c`](https://github.com/nodejs/node/commit/cd4b05469c)] - **tls**: fix ip normalization regression (James M Snell) [nodejs-private/node-private#985](https://github.com/nodejs-private/node-private/pull/985)
105+
* \[[`5fa440e0d7`](https://github.com/nodejs/node/commit/5fa440e0d7)] - **tools**: retry Gatekeeper check and stapling after notarization (Ryan Aslett) [#66855](https://github.com/nodejs/node/pull/66855)
106+
* \[[`745ad77156`](https://github.com/nodejs/node/commit/745ad77156)] - **zlib**: avoid caching invalid ZIP local headers (Matteo Collina) [nodejs-private/node-private#981](https://github.com/nodejs-private/node-private/pull/981)
107+
61108
<a id="26.12.0"></a>
62109

63110
## 2026-10-14, Version 26.12.0 (Current), @richardlau

‎src/node_version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
#define NODE_VERSION_IS_LTS 0
3030
#define NODE_VERSION_LTS_CODENAME ""
3131

32-
#define NODE_VERSION_IS_RELEASE 0
32+
#define NODE_VERSION_IS_RELEASE 1
3333

3434
#ifndef NODE_STRINGIFY
3535
#define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)

0 commit comments

Comments
 (0)