Node.js 26.5.1

Node.js 26.5.1 has been released as a security update addressing multiple CVEs across the runtime. Users are strongly encouraged to upgrade as soon as possible.

Security Fixes

This release patches 10 vulnerabilities, ranging from Low to High severity:

• CVE-2026-56848 (High) — http2: defer rst stream while in scope (Matteo Collina)
• CVE-2026-58043 (High) — permission: avoid granting radix split nodes (RafaelGSS)
• CVE-2026-56850 (Medium) — https: distinguish PFX object-array agent keys (RafaelGSS)
• CVE-2026-58040 (Medium) — https: bind identity checks to session reuse (Matteo Collina)
• CVE-2026-58041 (Medium) — sqlite: invalidate tag store iterators on statement reset (Matteo Collina)
• CVE-2026-58042 (Medium) — dns: handle large resolveAny address replies (RafaelGSS)
• CVE-2026-58045 (Medium) — zlib: throw on out-of-bounds write buffers (RafaelGSS)
• CVE-2026-56847 (Low) — permission: enforce fs write permission for trace events (RafaelGSS)
• CVE-2026-58039 (Low) — permission: check final report output path (RafaelGSS)
• CVE-2026-58044 (Low) — http: reject requests exceeding max header count (Matteo Collina)

Dependency Updates

• llhttp updated to 9.4.3
• undici updated to 8.9.0

Overview

Node.js 26.5.1 is a security release under the Current release line. No breaking changes are included — the focus is entirely on hardening the runtime against recently discovered vulnerabilities. The http2 and permission system patches address the most critical issues, while the dependency bumps to llhttp and undici bring in additional security fixes from the upstream projects.

If you are running Node.js 26.x, upgrade to 26.5.1. Users on older LTS lines (24.x, 22.x) should also check for corresponding security releases.