Skip to content

feat(blog): create post for v24.18.1 #9046

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
avivkeller merged 1 commit into from
Jul 29, 2026
Merged

feat(blog): create post for v24.18.1 #9046

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 106 additions & 0 deletions apps/site/pages/en/blog/release/v24.18.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
---
date: '2026-07-29T16:19:07.684Z'
category: release
title: Node.js 24.18.1 (LTS)
layout: blog-post
author: Juan José
---

## 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

This is a security release.

### Notable Changes

- (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
- deps: update llhttp to 9.4.3 (Paolo Insogna)
- deps: update undici to 7.29.0 (Node.js GitHub Bot)

### Commits

- \[[`6cb0475751`](https://github.com/nodejs/node/commit/6cb0475751)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
- \[[`bcfe21d3dc`](https://github.com/nodejs/node/commit/bcfe21d3dc)] - **deps**: update undici to 7.29.0 (Node.js GitHub Bot) [#64713](https://github.com/nodejs/node/pull/64713)
- \[[`9d0d36cffd`](https://github.com/nodejs/node/commit/9d0d36cffd)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
- \[[`8a008fb523`](https://github.com/nodejs/node/commit/8a008fb523)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
- \[[`a77c7f7354`](https://github.com/nodejs/node/commit/a77c7f7354)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
- \[[`34ed88a069`](https://github.com/nodejs/node/commit/34ed88a069)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#63752](https://github.com/nodejs/node/pull/63752)
- \[[`95ba2cfde7`](https://github.com/nodejs/node/commit/95ba2cfde7)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904)
- \[[`fcbdbe47ea`](https://github.com/nodejs/node/commit/fcbdbe47ea)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
- \[[`ea26c12b56`](https://github.com/nodejs/node/commit/ea26c12b56)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
- \[[`9a6b7e343a`](https://github.com/nodejs/node/commit/9a6b7e343a)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926)
- \[[`6c0c990880`](https://github.com/nodejs/node/commit/6c0c990880)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927)
- \[[`af9ff0490c`](https://github.com/nodejs/node/commit/af9ff0490c)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896)
- \[[`05f541b5c0`](https://github.com/nodejs/node/commit/05f541b5c0)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)

Windows 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-arm64.msi \
Windows 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-aix-ppc64.tar.gz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v24.18.1/node-v24.18.1.tar.gz \
Other release files: https://nodejs.org/dist/v24.18.1/ \
Documentation: https://nodejs.org/docs/v24.18.1/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

3c76240c07b9f03574a5cf8ed8ba19e8db89271943817b1a4b94de43c97a9e66 node-v24.18.1-aix-ppc64.tar.gz
c3897213475a089b526c8ffb5a84b0151d03eb2206d3e38aac44b2c053719b81 node-v24.18.1-arm64.msi
eb02f7fab96d3d67de40c5ec8566096fcb4c2026728787683ae5a97eb612b941 node-v24.18.1-darwin-arm64.tar.gz
1d60b703fe5d7e7072489be8187f430f1a095a658c31e5e1e281331a5873fac3 node-v24.18.1-darwin-arm64.tar.xz
6fb20fceacbb157c2f95825b80df4a454a0f6d81cdcd7bb81eeae9147e0e76ec node-v24.18.1-darwin-x64.tar.gz
f892c7895720f40d3750bde24f3554242d36f23602b5167b5b73ec4d13938aef node-v24.18.1-darwin-x64.tar.xz
bee7344a7fc6e3252c4822ca916a50cd6ddda9bb39374d6140a8046d9238fded node-v24.18.1-headers.tar.gz
38d44792ec2bee82aca52dbe166979a146f5e75e09ee35e0c0b017b8e2db7c48 node-v24.18.1-headers.tar.xz
df224555a083b918e46260cc969838501b9f9a87140c1195e5b9597b56d5dae2 node-v24.18.1-linux-arm64.tar.gz
7201e3a09dc825bac57867c81913e2b8f0ef87d04cb9082af4cda82f6ff3d88c node-v24.18.1-linux-arm64.tar.xz
4a8c6209ba3a5aea84c40201d896624ed706b9799a6dc54cbd965433a369a3d0 node-v24.18.1-linux-ppc64le.tar.gz
c47812c13862be7f6e71194c434c4d78a99096e72efb9c31a2627437e056d669 node-v24.18.1-linux-ppc64le.tar.xz
62ad850efefa9ab42a3e901d8e0de86d71bf9c8a0c389dabed248f1ec9590c5a node-v24.18.1-linux-s390x.tar.gz
acf57bd726f35afc2ba8475194e5a8bd532c00e1a3b2436295b2fbdde199d0e9 node-v24.18.1-linux-s390x.tar.xz
9f5eb6ac21845a66c493c91a253b1da32fd684e89e9b7202d4936982336be4ca node-v24.18.1-linux-x64.tar.gz
d6c664df3f3f61458e8c277585571328522d705166723a7c7823a9253a4d15a0 node-v24.18.1-linux-x64.tar.xz
c2e424f198dab39b5c68e8b06e0cdba9761dca9b5b432941fce6399d6460dabb node-v24.18.1.pkg
b62cd76de0a0a28dd9ff88580c92344bdeb008f21c1d7479c5d8659cd96ef4e2 node-v24.18.1.tar.gz
86d40d594bbdfcf69009a62fdf43cb19ae72b6cb5822d2bdd8349c5a1b2fa628 node-v24.18.1.tar.xz
8aed98bca9260716236be292807dcb2638827750ba2fbcfc684601a9a6b8ab48 node-v24.18.1-win-arm64.7z
ffbc7d3e1baf6804f7431ff94f19b9a885a650568c93ea4ccb1bb0038f6af825 node-v24.18.1-win-arm64.zip
365ecf84eeefb87a5a4c94f1e54919696cf5581285db4e589e84d46c0e167406 node-v24.18.1-win-x64.7z
ec56b84a7551893ab2324ebdfdc4ab974a63b4781162600b68a1293cc3e53765 node-v24.18.1-win-x64.zip
af4a0651a26f04ac240f00fec872f305547ca2aa56301c41dfd63a29eb2ab836 node-v24.18.1-x64.msi
845fc4ce00780241667f92e8f7a3a679321a655dddb3b610f2d85693b17ddf28 win-arm64/node.exe
7da03c5111815b69bbe63ffd2e51b28cd69eec9f545b7ccb8756efffdbb88dc2 win-arm64/node.lib
86a5fa89be9c19be42864edfbc2721931fa3c5b318c0f5cd7c1b5c0f49c1f259 win-arm64/node_pdb.7z
0e085f6058961484fb7e93a35ccd0b1ff02efed7bfe1387203097614dc9864a2 win-arm64/node_pdb.zip
ac51903c4c111815d52280b1fdcc8da067cbb37e2fe1a765097b85c3292c8582 win-x64/node.exe
589684168a73547ca47cd22d76a4e465ef561abe89fb1b2b23fe35bbe857d505 win-x64/node.lib
50155c3c9afe1c3ce9a57a8763ed421acc72845c2d30f79d93afe73cb65473ef win-x64/node_pdb.7z
a9970c87747af4ef15524240dc28ebcf64080c7a68e39d2a406b743e438b6a20 win-x64/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQTdeS9Zc8beUsQyy9rHer+gDdvytwUCamomTgAKCRDHer+gDdvy
twyzAQDrLBWmNsaCn+z0wLyVZgHGA4R5wjJcIil2aKvsiiwDgwEAosTcDL1Me9tq
sDclFViJ4DaRM2efOzyjeLKf/qKH+go=
=4N8e
-----END PGP SIGNATURE-----
```
Loading