Skip to content

Commit c8d3916

Browse files
aduh95aduh95
committed
2026-06-18, Version 26.3.1 (Current)
This is a security release. Notable changes: * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low * (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low PR-URL: nodejs-private/node-private#897
1 parent 98fbc89 commit c8d3916

4 files changed

Lines changed: 45 additions & 3 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ release.
4242
</tr>
4343
<tr>
4444
<td valign="top">
45-
<b><a href="doc/changelogs/CHANGELOG_V26.md#26.3.0">26.3.0</a></b><br/>
45+
<b><a href="doc/changelogs/CHANGELOG_V26.md#26.3.1">26.3.1</a></b><br/>
46+
<a href="doc/changelogs/CHANGELOG_V26.md#26.3.0">26.3.0</a><br/>
4647
<a href="doc/changelogs/CHANGELOG_V26.md#26.2.0">26.2.0</a><br/>
4748
<a href="doc/changelogs/CHANGELOG_V26.md#26.1.0">26.1.0</a><br/>
4849
<a href="doc/changelogs/CHANGELOG_V26.md#26.0.0">26.0.0</a><br/>

‎doc/api/errors.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1761,7 +1761,7 @@ as specified through the `maxSessionInvalidFrames` option, has been exceeded.
17611761
### `ERR_HTTP2_TOO_MANY_ORIGINS`
17621762

17631763
<!-- YAML
1764-
added: REPLACEME
1764+
added: v26.3.1
17651765
-->
17661766

17671767
The number of uniq origin sent by the server has exceeded the value defined in

‎doc/changelogs/CHANGELOG_V26.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
</tr>
99
<tr>
1010
<td>
11+
<a href="#26.3.1">26.3.1</a><br/>
1112
<a href="#26.3.0">26.3.0</a><br/>
1213
<a href="#26.2.0">26.2.0</a><br/>
1314
<a href="#26.1.0">26.1.0</a><br/>
@@ -44,6 +45,46 @@
4445
* [io.js](CHANGELOG_IOJS.md)
4546
* [Archive](CHANGELOG_ARCHIVE.md)
4647

48+
<a id="26.3.1"></a>
49+
50+
## 2026-06-18, Version 26.3.1 (Current), @aduh95
51+
52+
This is a security release.
53+
54+
### Notable Changes
55+
56+
* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
57+
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
58+
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
59+
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
60+
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
61+
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
62+
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
63+
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
64+
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
65+
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
66+
* (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low
67+
68+
### Commits
69+
70+
* \[[`98fbc89211`](https://github.com/nodejs/node/commit/98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
71+
* \[[`110840f2c7`](https://github.com/nodejs/node/commit/110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
72+
* \[[`8d36d522b2`](https://github.com/nodejs/node/commit/8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](https://github.com/nodejs/node/pull/63903)
73+
* \[[`2e6d03993a`](https://github.com/nodejs/node/commit/2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](https://github.com/nodejs/node/pull/63779)
74+
* \[[`5a17d5b07a`](https://github.com/nodejs/node/commit/5a17d5b07a)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
75+
* \[[`362725d4e5`](https://github.com/nodejs/node/commit/362725d4e5)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
76+
* \[[`bd1214ab01`](https://github.com/nodejs/node/commit/bd1214ab01)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
77+
* \[[`bc0b53813e`](https://github.com/nodejs/node/commit/bc0b53813e)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
78+
* \[[`87d847bc70`](https://github.com/nodejs/node/commit/87d847bc70)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
79+
* \[[`9308084fcb`](https://github.com/nodejs/node/commit/9308084fcb)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
80+
* \[[`a67dd46891`](https://github.com/nodejs/node/commit/a67dd46891)] - **(CVE-2026-48936)** **permission**: guard pipe open and chmod with net scope (RafaelGSS) [nodejs-private/node-private#885](https://github.com/nodejs-private/node-private/pull/885)
81+
* \[[`7057c3f16c`](https://github.com/nodejs/node/commit/7057c3f16c)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
82+
* \[[`6bc17a6b51`](https://github.com/nodejs/node/commit/6bc17a6b51)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870)
83+
* \[[`c8668beff8`](https://github.com/nodejs/node/commit/c8668beff8)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
84+
* \[[`d1be630415`](https://github.com/nodejs/node/commit/d1be630415)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
85+
* \[[`a14c158bb3`](https://github.com/nodejs/node/commit/a14c158bb3)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857)
86+
* \[[`ebda73470d`](https://github.com/nodejs/node/commit/ebda73470d)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869)
87+
4788
<a id="26.3.0"></a>
4889

4990
## 2026-06-01, Version 26.3.0 (Current), @aduh95

‎src/node_version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
#define NODE_VERSION_IS_LTS 0
3030
#define NODE_VERSION_LTS_CODENAME ""
3131

32-
#define NODE_VERSION_IS_RELEASE 0
32+
#define NODE_VERSION_IS_RELEASE 1
3333

3434
#ifndef NODE_STRINGIFY
3535
#define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)

0 commit comments

Comments
 (0)