From 6d51941d63c5b5c9e8548ee0b43fba0d82e64cb4 Mon Sep 17 00:00:00 2001 From: Create or Update Pull Request Action Date: Wed, 29 Jul 2026 16:19:08 +0000 Subject: [PATCH] feat(blog): create post for v24.18.1 --- apps/site/pages/en/blog/release/v24.18.1.md | 106 ++++++++++++++++++++ 1 file changed, 106 insertions(+) create mode 100644 apps/site/pages/en/blog/release/v24.18.1.md diff --git a/apps/site/pages/en/blog/release/v24.18.1.md b/apps/site/pages/en/blog/release/v24.18.1.md new file mode 100644 index 0000000000000..62d1858cbcb9b --- /dev/null +++ b/apps/site/pages/en/blog/release/v24.18.1.md @@ -0,0 +1,106 @@ +--- +date: '2026-07-29T16:19:07.684Z' +category: release +title: Node.js 24.18.1 (LTS) +layout: blog-post +author: Juan José +--- + +## 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol + +This is a security release. + +### Notable Changes + +- (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High +- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High +- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High +- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium +- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium +- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium +- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium +- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium +- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low +- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low +- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low +- deps: update llhttp to 9.4.3 (Paolo Insogna) +- deps: update undici to 7.29.0 (Node.js GitHub Bot) + +### Commits + +- \[[`6cb0475751`](https://github.com/nodejs/node/commit/6cb0475751)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) +- \[[`bcfe21d3dc`](https://github.com/nodejs/node/commit/bcfe21d3dc)] - **deps**: update undici to 7.29.0 (Node.js GitHub Bot) [#64713](https://github.com/nodejs/node/pull/64713) +- \[[`9d0d36cffd`](https://github.com/nodejs/node/commit/9d0d36cffd)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) +- \[[`8a008fb523`](https://github.com/nodejs/node/commit/8a008fb523)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) +- \[[`a77c7f7354`](https://github.com/nodejs/node/commit/a77c7f7354)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921) +- \[[`34ed88a069`](https://github.com/nodejs/node/commit/34ed88a069)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#63752](https://github.com/nodejs/node/pull/63752) +- \[[`95ba2cfde7`](https://github.com/nodejs/node/commit/95ba2cfde7)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904) +- \[[`fcbdbe47ea`](https://github.com/nodejs/node/commit/fcbdbe47ea)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930) +- \[[`ea26c12b56`](https://github.com/nodejs/node/commit/ea26c12b56)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911) +- \[[`9a6b7e343a`](https://github.com/nodejs/node/commit/9a6b7e343a)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926) +- \[[`6c0c990880`](https://github.com/nodejs/node/commit/6c0c990880)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927) +- \[[`af9ff0490c`](https://github.com/nodejs/node/commit/af9ff0490c)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896) +- \[[`05f541b5c0`](https://github.com/nodejs/node/commit/05f541b5c0)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931) + +Windows 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-arm64.msi \ +Windows 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-aix-ppc64.tar.gz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v24.18.1/node-v24.18.1.tar.gz \ +Other release files: https://nodejs.org/dist/v24.18.1/ \ +Documentation: https://nodejs.org/docs/v24.18.1/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +3c76240c07b9f03574a5cf8ed8ba19e8db89271943817b1a4b94de43c97a9e66 node-v24.18.1-aix-ppc64.tar.gz +c3897213475a089b526c8ffb5a84b0151d03eb2206d3e38aac44b2c053719b81 node-v24.18.1-arm64.msi +eb02f7fab96d3d67de40c5ec8566096fcb4c2026728787683ae5a97eb612b941 node-v24.18.1-darwin-arm64.tar.gz +1d60b703fe5d7e7072489be8187f430f1a095a658c31e5e1e281331a5873fac3 node-v24.18.1-darwin-arm64.tar.xz +6fb20fceacbb157c2f95825b80df4a454a0f6d81cdcd7bb81eeae9147e0e76ec node-v24.18.1-darwin-x64.tar.gz +f892c7895720f40d3750bde24f3554242d36f23602b5167b5b73ec4d13938aef node-v24.18.1-darwin-x64.tar.xz +bee7344a7fc6e3252c4822ca916a50cd6ddda9bb39374d6140a8046d9238fded node-v24.18.1-headers.tar.gz +38d44792ec2bee82aca52dbe166979a146f5e75e09ee35e0c0b017b8e2db7c48 node-v24.18.1-headers.tar.xz +df224555a083b918e46260cc969838501b9f9a87140c1195e5b9597b56d5dae2 node-v24.18.1-linux-arm64.tar.gz +7201e3a09dc825bac57867c81913e2b8f0ef87d04cb9082af4cda82f6ff3d88c node-v24.18.1-linux-arm64.tar.xz +4a8c6209ba3a5aea84c40201d896624ed706b9799a6dc54cbd965433a369a3d0 node-v24.18.1-linux-ppc64le.tar.gz +c47812c13862be7f6e71194c434c4d78a99096e72efb9c31a2627437e056d669 node-v24.18.1-linux-ppc64le.tar.xz +62ad850efefa9ab42a3e901d8e0de86d71bf9c8a0c389dabed248f1ec9590c5a node-v24.18.1-linux-s390x.tar.gz +acf57bd726f35afc2ba8475194e5a8bd532c00e1a3b2436295b2fbdde199d0e9 node-v24.18.1-linux-s390x.tar.xz +9f5eb6ac21845a66c493c91a253b1da32fd684e89e9b7202d4936982336be4ca node-v24.18.1-linux-x64.tar.gz +d6c664df3f3f61458e8c277585571328522d705166723a7c7823a9253a4d15a0 node-v24.18.1-linux-x64.tar.xz +c2e424f198dab39b5c68e8b06e0cdba9761dca9b5b432941fce6399d6460dabb node-v24.18.1.pkg +b62cd76de0a0a28dd9ff88580c92344bdeb008f21c1d7479c5d8659cd96ef4e2 node-v24.18.1.tar.gz +86d40d594bbdfcf69009a62fdf43cb19ae72b6cb5822d2bdd8349c5a1b2fa628 node-v24.18.1.tar.xz +8aed98bca9260716236be292807dcb2638827750ba2fbcfc684601a9a6b8ab48 node-v24.18.1-win-arm64.7z +ffbc7d3e1baf6804f7431ff94f19b9a885a650568c93ea4ccb1bb0038f6af825 node-v24.18.1-win-arm64.zip +365ecf84eeefb87a5a4c94f1e54919696cf5581285db4e589e84d46c0e167406 node-v24.18.1-win-x64.7z +ec56b84a7551893ab2324ebdfdc4ab974a63b4781162600b68a1293cc3e53765 node-v24.18.1-win-x64.zip +af4a0651a26f04ac240f00fec872f305547ca2aa56301c41dfd63a29eb2ab836 node-v24.18.1-x64.msi +845fc4ce00780241667f92e8f7a3a679321a655dddb3b610f2d85693b17ddf28 win-arm64/node.exe +7da03c5111815b69bbe63ffd2e51b28cd69eec9f545b7ccb8756efffdbb88dc2 win-arm64/node.lib +86a5fa89be9c19be42864edfbc2721931fa3c5b318c0f5cd7c1b5c0f49c1f259 win-arm64/node_pdb.7z +0e085f6058961484fb7e93a35ccd0b1ff02efed7bfe1387203097614dc9864a2 win-arm64/node_pdb.zip +ac51903c4c111815d52280b1fdcc8da067cbb37e2fe1a765097b85c3292c8582 win-x64/node.exe +589684168a73547ca47cd22d76a4e465ef561abe89fb1b2b23fe35bbe857d505 win-x64/node.lib +50155c3c9afe1c3ce9a57a8763ed421acc72845c2d30f79d93afe73cb65473ef win-x64/node_pdb.7z +a9970c87747af4ef15524240dc28ebcf64080c7a68e39d2a406b743e438b6a20 win-x64/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iHUEARYIAB0WIQTdeS9Zc8beUsQyy9rHer+gDdvytwUCamomTgAKCRDHer+gDdvy +twyzAQDrLBWmNsaCn+z0wLyVZgHGA4R5wjJcIil2aKvsiiwDgwEAosTcDL1Me9tq +sDclFViJ4DaRM2efOzyjeLKf/qKH+go= +=4N8e +-----END PGP SIGNATURE----- +```