马可·伊波利托(Marco Ippolito)
2026年3月24日，版本20.20.2 'Iron' (LTS), @marco-ippolito
这是一个安全版本。
重要变更
- (CVE-2026-21717) 修复数组索引哈希碰撞 (张乔伊 (Joyee Cheung))https://github.com/nodejs-private/node-private/pull/834
- 在Web Cryptography HMAC和KMAC中使用时间安全比较（CVE-2026-21713）（Filip Skokan）https://github.com/nodejs-private/node-private/pull/822
- (CVE-2026-21710) 为 headersDistinct/trailersDistinct 使用 null 原型 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/821
- (CVE-2026-21716) 在 lib/fs/promises 中包含权限检查 (RafaelGSS) https://github.com/nodejs-private/node-private/pull/795
- (CVE-2026-21715) 为 realpath.native 添加权限检查 (RafaelGSS) https://github.com/nodejs-private/node-private/pull/794
- (CVE-2026-21714) 处理 NGHTTP2_ERR_FLOW_CONTROL 错误码 (RafaelGSS)https://github.com/nodejs-private/node-private/pull/832
- (CVE-2026-21637) 将 SNICallback 调用包装在 try/catch 中 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/819
提交
- [
cfb51fa9ce] - (CVE-2026-21713) crypto: 在 Web Cryptography HMAC 中使用时序安全比较 (Filip Skokan) nodejs-private/node-private#831 - [
f333d0be5f] -依赖: V8: 覆盖depot_tools版本 (Richard Lau) #62344 - [
2acd5d1226] - 依赖: 将 undici 更新到 v6.24.1 (Matteo Collina) #62285 - [
af5c144ebc] - (CVE-2026-21717) 依赖,构建,测试: 修复数组索引哈希碰撞 (Joyee Cheung)nodejs-private/node-private#834 - [
00ad47a28e] - (CVE-2026-21710) http: 为headersDistinct/trailersDistinct使用null原型 (Matteo Collina) nodejs-private/node-private#821 - [
0123309566] - (CVE-2026-21716) 权限：在 lib/fs/promises 中包含权限检查 (RafaelGSS) nodejs-private/node-private#840 - [
00830712bc] - (CVE-2026-21715) 权限：向 realpath.native 添加权限检查 (RafaelGSS) nodejs-private/node-private#838 - [
a0c73425da] - (CVE-2026-21714) src: 处理 NGHTTP2_ERR_FLOW_CONTROL 错误码 (RafaelGSS) nodejs-private/node-private#832 - [
cc3f294507] - (CVE-2026-21637) tls: 将 SNICallback 调用包装在 try/catch 中 (Matteo Collina) nodejs-private/node-private#839
Windows 32位安装程序: https://nodejs.org/dist/v20.20.2/node-v20.20.2-x86.msi
Windows 64位安装程序:https://nodejs.org/dist/v20.20.2/node-v20.20.2-x64.msi
Windows ARM 64位安装程序: https://nodejs.org/dist/v20.20.2/node-v20.20.2-arm64.msi
Windows 32位二进制文件: https://nodejs.org/dist/v20.20.2/win-x86/node.exe
Windows 64位二进制文件: https://nodejs.org/dist/v20.20.2/win-x64/node.exe
Windows ARM 64位二进制文件: https://nodejs.org/dist/v20.20.2/win-arm64/node.exe
macOS 64位安装程序: https://nodejs.org/dist/v20.20.2/node-v20.20.2.pkg
macOS Apple Silicon 64位二进制文件：https://nodejs.org/dist/v20.20.2/node-v20.20.2-darwin-arm64.tar.gz
macOS Intel 64位二进制文件：https://nodejs.org/dist/v20.20.2/node-v20.20.2-darwin-x64.tar.gz
Linux 64位二进制文件：https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-x64.tar.xz
Linux PPC LE 64位二进制文件：https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-ppc64le.tar.xz
Linux s390x 64位二进制文件：https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-s390x.tar.xz
AIX 64位二进制文件：https://nodejs.org/dist/v20.20.2/node-v20.20.2-aix-ppc64.tar.gz
ARMv7 32位二进制文件: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-armv7l.tar.xz
ARMv8 64位二进制文件: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-arm64.tar.xz
源代码: https://nodejs.org/dist/v20.20.2/node-v20.20.2.tar.gz
其他发布文件: https://nodejs.org/dist/v20.20.2/
文档: https://nodejs.org/docs/v20.20.2/api/
SHA校验和
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
3c60f54069a53ad8ffeef2b0f11e1f88333b12decfed755b26ce3fcb5e2d97e4 node-v20.20.2-aix-ppc64.tar.gz
1473f48d689627ec35eb4147d0f22ee60c694f16719c20a7c129b925c60f3a2f node-v20.20.2-arm64.msi
466e05f3477c20dfb723054dfebffe55bc74660ee77f612166fca121dacb65b6 node-v20.20.2-darwin-arm64.tar.gz
6375a1d4421bc04ab284ba89459df788a78c49c89e83c463d0eede47e2efc07b node-v20.20.2-darwin-arm64.tar.xz
8be6f5e4bb128c82774f8a0b8d7a1cc1365a7977d9657cece0ca647b3fe04e61 node-v20.20.2-darwin-x64.tar.gz
4d4c020eb534497e616de38f3733289ff33c615ddab38c048edec6547b7f76ea node-v20.20.2-darwin-x64.tar.xz
6de0e836efa9f32512e61db3dfd08b3d97a015b7e828d1a5efdf281a56a692d9 node-v20.20.2-headers.tar.gz
46573741c48c20c6bcfc71450e2fc56b4d1156d72c3d6cc9917fa8b1cbc6e836 node-v20.20.2-headers.tar.xz
47ef73d543ecf6eb19435f6c03a0ac4809b3bf0dd6b26c7c571efc2a6572a74d node-v20.20.2-linux-arm64.tar.gz
73093db209e4e9e09dd7d15a47aeaab1b74833830df03efa5f942a1122c5fa71 node-v20.20.2-linux-arm64.tar.xz
8e15f121e721c9354132053188d4c1a18ea9e345c019ee440fb256e3dda7df15 node-v20.20.2-linux-armv7l.tar.gz
f704ce75d9a194c30c378049b516000e49612c2f046ac83c7435eb33ec2926f0 node-v20.20.2-linux-armv7l.tar.xz
5f2fd0e0cd67aeac0db800b334151cae6ea70ea337487b26f79ac90e3fe126e1 node-v20.20.2-linux-ppc64le.tar.gz
4ee91307b3b517f880cd63d3f75fc91f4afc926ad9447661b755d50060ba2816 node-v20.20.2-linux-ppc64le.tar.xz
ee1ca1193e75a6d31b6007c575deca11b116e84a6bda136ae0e0dbe19399889c node-v20.20.2-linux-s390x.tar.gz
00590e7e1295d265fd22706e10467c03ecf170873b76c1835ff74b47b90ce6e0 node-v20.20.2-linux-s390x.tar.xz
19e56f0825510207dd904f087fe52faa0a4eb6b2aab5f0ea7a33830d04888b8b node-v20.20.2-linux-x64.tar.gz
df770b2a6f130ed8627c9782c988fda9669fa23898329a61a871e32f965e007d node-v20.20.2-linux-x64.tar.xz
63be4e81a9248c5a5ff5f4a67efffef6a4eaa976f5c7fb0b93027db36342e9a3 node-v20.20.2.pkg
8cb85a81f75169eb811f7b2512cf17a646826430debbe016a7461f31e286fdef node-v20.20.2.tar.gz
7aeeacdb858299e09a3e0510d4bb8b266923894a9e3ac0058ba89d4ecf4a4cca node-v20.20.2.tar.xz
f066ba3f80363f8e16a2737a945052ea910733f22c93821519f53667614bafd0 node-v20.20.2-win-arm64.7z
d5c5b1d56f7f9469830eb1f57efeec0a6a9078c0a9e88cd5b4b4b48f46c22069 node-v20.20.2-win-arm64.zip
1bbbfd0312335a95e86642c3beef98bb84def4cca85cd879f3da0baca6797422 node-v20.20.2-win-x64.7z
dc3700fdd57a63eedb8fd7e3c7baaa32e6a740a1b904167ff4204bc68ed8bf77 node-v20.20.2-win-x64.zip
4103cb79dba8c0272e309f8b337c2240369fcba5454bf10c2c4b23932a3c6033 node-v20.20.2-win-x86.7z
cd34d5da2f36ebd84ed57252756ee512447db4502d9f9e38ca8dccb511b0b352 node-v20.20.2-win-x86.zip
9a283dcdb771793d6492235e81f3fc80048db8a37497a0af87b0a9f450d10fa6 node-v20.20.2-x64.msi
5bd11635c4d46a14e5f712ffbddf07a8dc01d6e62c5ac1d20cab47b4fd7f5ce0 node-v20.20.2-x86.msi
a6c4adc2ea22256b5d2df57a981f1538d56d44fc845646a8bdbf66740ac1e948 win-arm64/node.exe
deacf784c804e5ab9df886b2de4c7a04d77ee1c722e2e4f1567aac62391ec4c4 win-arm64/node.lib
46512faa28642586c97e61b1a1431bc0a3b2a85e1d63a22794df3b7ebf8d4cfd win-arm64/node_pdb.7z
9a6ba8c56d58883584a27f861c784f203455e9ae4dd882836b16980c95dfa84c win-arm64/node_pdb.zip
56c1520ee33b801e8bdb92fb321cf2e98529735b6d12bd4a2a6dec0ac0bab937 win-x64/node.exe
c4a794e993d9304238523230885e9ec00ca052c73b9558471858eef14916d91f win-x64/node.lib
e190b1166cce167651d3bd544881420e4642ef2dfc643da0023dee9f91f44046 win-x64/node_pdb.7z
656f2062e5cb3057651381d0916ad79b9e2113625572a0745b70bc6844e4196a win-x64/node_pdb.zip
33379026333558256e5f467d80c67ba20f6b8e77e8d3ab72ad4dc005f6e11845 win-x86/node.exe
962e762b899969e773dc1163d53f1dca10a7769d73217b727a94574d2613355b win-x86/node.lib
a1f7bfe7e5536488b9270f1c1ea1d5b259753b7ee89dabf8eaabc59bfc26fb60 win-x86/node_pdb.7z
f9d592b4c57c9749d33570e80f6d63c4aaa2441fb86347c25b81d988c5955889 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEzGj1oxBv9EgyLkjtJ/XjjVsKIV8FAmnC9VIACgkQJ/XjjVsK
IV//Pw//am3VN5wTtH+XMPNIyiFk7yrJPYKFhUPchoYVhKSjmnbdD6zn8F4n5KO6
t3P5mORXBai0GDBZA219moPX4CpBlVMDWUm87SPndc2nzS0PiGn/9b2vBOYErvel
lGPVaRq6MYE4mTKLIFBoApjJ5mBPPWWnzPOgB0nRw08Uv4rjWS88P4R7qohz2+V0
L/Szen1f/9F3ev9mGpFXlx4ylNww0ZDu0uJySweZEJE/9s5fq1EkGNQA4zpYpnyU
oqWHcL7ugQI7/2pQbUYk2W8WXTLi8bBuzjmP6mqetXDzltwchjtB8tmZhBqTKtPP
QrS0EcS3POe3hrriuqbm/VarpoRiOgexAG4YuzAMIldcSxNYMteSiP95WvPUfa9i
R7gcZ3KVyOVTtXUTTTqLWQrmzFeDmJNm1Y2n3B+mhKub8PuDwOMbvb77IoV51Azu
NpFSA+QmosLN3G/ydJI4L4JDme9MaYHPRSmBvEMryvpqNWjVoUn8OkHlmgGGreFu
QjyfxBzpYXkxkUHHt68wgIC/odUMxuiBWzLQ3pDlKgnR4bLL/uc+GnzXR6JES71X
NhZAwfLVFTQSBd6oq1ibU1SEObAVe4cIQEezwqT0qy2WFiyikXlgCNRHYtSPtjsf
A5s7j3cE8/naM28vHrt3kLmLIb5Gik5SL+N4Hig18vwKCyk+KkI=
=CXge
-----END PGP SIGNATURE-----