Rafael Gonzaga
2026-03-24, Version 22.22.2 'Jod' (LTS), @RafaelGSS prepared by @aduh95
This is a security release.
Notable Changes
- (CVE-2026-21637) wrap
SNICallbackinvocation intry/catch(Matteo Collina) - High - (CVE-2026-21710) use null prototype for
headersDistinct/trailersDistinct(Matteo Collina) - High - (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
- (CVE-2026-21714) handle
NGHTTP2_ERR_FLOW_CONTROLerror code (RafaelGSS) - Medium - (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
- (CVE-2026-21715) add permission check to
realpath.native(RafaelGSS) - Low - (CVE-2026-21716) include permission check on
lib/fs/promises(RafaelGSS) - Low
Commits
- [
6f14ee5101] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#809 - [
52a52ef619] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#822 - [
30a3ab11e2] - (CVE-2026-21717) deps: V8: cherry-pick aac14dd95e5b (Joyee Cheung) nodejs-private/node-private#809 - [
e3f4d6a42e] - (CVE-2026-21717) deps: V8: backport 1361b2a49d02 (Joyee Cheung) nodejs-private/node-private#809 - [
7dc00fa5f4] - (CVE-2026-21717) deps: V8: backport 185f0fe09b72 (Joyee Cheung) nodejs-private/node-private#809 - [
076acd052d] - (CVE-2026-21717) deps: V8: backport 0a8b1cdcc8b2 (snek) nodejs-private/node-private#809 - [
963c60a951] - deps: V8: overridedepot_toolsversion (Richard Lau) #62344 - [
a688117d5d] - deps: upgrade npm to 10.9.7 (npm team) #62330 - [
859c8c761b] - deps: update undici to v6.24.1 (Matteo Collina) #62285 - [
d5ed384a2f] - deps: upgrade npm to 10.9.6 (npm team) #62215 - [
a2fe9fd81a] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821 - [
73deff77c1] - lib: backport_tls_commonand_tls_wraprefactors (Dario Piotrowicz) #57643 - [
06fc3436f6] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#795 - [
db48d9c675] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#794 - [
2a6105a63b] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832 - [
91b970886f] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#819
Windows 32-bit Installer: https://nodejs.org/dist/v22.22.2/node-v22.22.2-x86.msi
Windows 64-bit Installer: https://nodejs.org/dist/v22.22.2/node-v22.22.2-x64.msi
Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.22.2/node-v22.22.2-arm64.msi
Windows 32-bit Binary: https://nodejs.org/dist/v22.22.2/win-x86/node.exe
Windows 64-bit Binary: https://nodejs.org/dist/v22.22.2/win-x64/node.exe
Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.22.2/win-arm64/node.exe
macOS 64-bit Installer: https://nodejs.org/dist/v22.22.2/node-v22.22.2.pkg
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-darwin-arm64.tar.gz
macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-darwin-x64.tar.gz
Linux 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-x64.tar.xz
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-ppc64le.tar.xz
Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-s390x.tar.xz
AIX 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-aix-ppc64.tar.gz
ARMv7 32-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-armv7l.tar.xz
ARMv8 64-bit Binary: https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-arm64.tar.xz
Source Code: https://nodejs.org/dist/v22.22.2/node-v22.22.2.tar.gz
Other release files: https://nodejs.org/dist/v22.22.2/
Documentation: https://nodejs.org/docs/v22.22.2/api/
SHASUMS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
31e8cdaf9921589c2978fd224aa5ae51e470577df63435ebfff16b715ed8d4d3 node-v22.22.2-aix-ppc64.tar.gz
1ec02aeb76d716ce15915bed10c0a4dcf9a6224e9a4f4d1645ddca4985a7bc06 node-v22.22.2-arm64.msi
db4b275b83736df67533529a18cc55de2549a8329ace6c7bcc68f8d22d3c9000 node-v22.22.2-darwin-arm64.tar.gz
f8655beb4b86ff6588ed7e02c37f8574b58557bd3e880012814b1a4956fd9d88 node-v22.22.2-darwin-arm64.tar.xz
12a6abb9c2902cf48a21120da13f87fde1ed1b71a13330712949e8db818708ba node-v22.22.2-darwin-x64.tar.gz
b6a384bba1a7ec585e5a91a452b63f676b940584ff57b5c9cf0541c8db60023e node-v22.22.2-darwin-x64.tar.xz
90e5ef0fdf02f88487f904a798836b35bd44896046d502873bc625ac2baeded2 node-v22.22.2-headers.tar.gz
b4dde76c01769ae141de9228cc47dd53853cde2fd94f7d40192273ec79dd405b node-v22.22.2-headers.tar.xz
b2f3a96f31486bfc365192ad65ced14833ad2a3c2e1bcefec4846902f264fa28 node-v22.22.2-linux-arm64.tar.gz
e9e1930fd321a470e29bb68f30318bf58e3ecb4acb4f1533fb19c58328a091fe node-v22.22.2-linux-arm64.tar.xz
465162c9e1821b2168b2740351ae8f191b24b58313f0cf9873a7ccd200a66e12 node-v22.22.2-linux-armv7l.tar.gz
2ebc6746e517f345da340ec76a108203eb6c2365391eb525c0e0dd6135b0b9df node-v22.22.2-linux-armv7l.tar.xz
f661dd525231faf113bd484129169d222b84ef40c091b5dca04a104d43e25d07 node-v22.22.2-linux-ppc64le.tar.gz
14045b5a5030d35ca0030fb7e870bd11a651eb9b57323ebc0021e8d78ac6bac9 node-v22.22.2-linux-ppc64le.tar.xz
4c28684a4c75683c491464f7fa168cd37752ed343fc27fb85b75806517e340cb node-v22.22.2-linux-s390x.tar.gz
9e4a07c291b8949289c6ea8ee61b1d14666a4810feae776a8d1eb1f57e03a2fb node-v22.22.2-linux-s390x.tar.xz
978978a635eef872fa68beae09f0aad0bbbae6757e444da80b570964a97e62a3 node-v22.22.2-linux-x64.tar.gz
88fd1ce767091fd8d4a99fdb2356e98c819f93f3b1f8663853a2dee9b438068a node-v22.22.2-linux-x64.tar.xz
ed1b73ffb642978e669786f9115d2579e890a3f9bf3dcd7c73272047b4895a17 node-v22.22.2-win-arm64.7z
380d375cf650c5a7f2ef3ce29ac6ea9a1c9d2ec8ea8e8391e1a34fd543886ab3 node-v22.22.2-win-arm64.zip
c87622c838f312d1fcc635e09034013e983ebe8df039a62ab46c22b34b9b8a0c node-v22.22.2-win-x64.7z
7c93e9d92bf68c07182b471aa187e35ee6cd08ef0f24ab060dfff605fcc1c57c node-v22.22.2-win-x64.zip
d73718f162d286d1deaf911d8bf224ba823a877cd0ed23c0d09b43923f6bd699 node-v22.22.2-win-x86.7z
ca892f829a733109e341c43585fd2094177e9d2f2c45f97c7ed3cf329d5427c5 node-v22.22.2-win-x86.zip
57456aa33fcd6fb6a9418e09227de0b0ca604f7b2123566acc66b555cb2f42e5 node-v22.22.2-x64.msi
e43cf42f461cbfea23a079925cfdd132a18cf66d4e30f64ec5ab4ec31dbb41f3 node-v22.22.2-x86.msi
ff08ad19678de4ca2af34b58b73b272c555449c6f2d91487ca6fe0a697f9eabe node-v22.22.2.pkg
f4b9606f33aef725a77b6292460102b48b80902571a8bb94cd769837ee0577df node-v22.22.2.tar.gz
b6bedd3a8cacd5df7df015a5088264b12c74a277ba60684cb9642ae8eb743132 node-v22.22.2.tar.xz
1a338f2467a566197ed8b309240a3a372f5d72458f9c7e5c9613ad6ccae1e0c0 win-arm64/node.exe
9b75bbc3be72c84f1d41cd6abb6e5ecc333836015e40a6267ce755554874a13a win-arm64/node.lib
d8439627dd1081c37267c77a79cf7f21c0a7cfd85c582fc3d6361d4b6a720388 win-arm64/node_pdb.7z
76a309aae5afd000b87359a4d26c2392dfc231ef626c1a77ec103452677edad4 win-arm64/node_pdb.zip
ae1a50511be58e987483fdbc12125407443926d2d394669ade2352776e920dd3 win-x64/node.exe
0d8d8bcc11daea60f5dd4da414e72ccb785718345ec8fbec52cfc7d1a2326293 win-x64/node.lib
0431a2383c9ceec6bd46d5d96fec1342c0adf7bd57528312fe4812e32e1d2e5c win-x64/node_pdb.7z
7a5071732adc414638f4a8e06926820410dfd6421badbe0221dfa594ec2a766f win-x64/node_pdb.zip
ed2aff66c21ea111e517b3c8a6857c35d222cc83e12ff66d9c03b61e2e0558e7 win-x86/node.exe
a07e94777fb491c1a59103b6987417df35a1dd0a9682220bba43d3c602b8b414 win-x86/node.lib
0f43bd6b98aa25bc7067cf374de59ec853035778ff4b6ce2fb118dc67f5eaee9 win-x86/node_pdb.7z
ffd472e223a8dbde11867016e51744dadb3e55af8dc3d663fb605a1560a63017 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmnC9gcACgkQi+q0389V
XvR1ugwAiiv5SVNLVMJa5ww1CtXHbVX7Kd1vGXw9INsK1iIUrwT4T2lZa+KnztYx
ngwaxIa8h4/x9IS262tRYJUHqcQtRP+J8pD7ahnf+JW5BZN9HQ+C1jEy6TWrH5rt
zQfFUYrRM7jbWPXlDmFecBPpOC48mZyOe8I7UzDjQGY1KYx6HHutUi28bAbPxzi+
CzcpgsdhD/y/qhQW/DtlmFj4AWh1oFzZZW3C0mNRNgC96FVs61Xp4CXfiPO9vFwY
VjB2JHYkxVx2K1m5O4CcrtEEtg7LBpuzCNke/INnKXdh4UDqSBGXm/oAvl71VLgH
aICjDIKcS4TXmWmaSbPN4y6Lfe30a8CESRolX/5nvzAyQy/pVmmhyi1l15IzAQDu
b/efW5bZn7wJTcNJz64vqXNPE1eKfJES7cAabDkvxnAWQhf9JtZf406QH5c+Ygig
Yo/97a00Pv6/nBJLF4woxYBjG5/2hKxuhkOKQ9QnDqCXW0ACpWHn1aX+Stv5s6Ps
JNKkGS1v
=uiHn
-----END PGP SIGNATURE-----