Download Latest Version
2026-10-28, Version 26.13.0 _Lithium_ (LTS), @richardlau source code.zip (171.4 MB)
Add to Preferred Sources
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS source code.tar.gz | 2026-10-21 | 141.0 MB | |
| 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS source code.zip | 2026-10-21 | 171.4 MB | |
| README.md | 2026-10-21 | 6.0 kB | |
| Totals: 3 Items | 312.4 MB | 31 | |
This is a security release.
Notable Changes
- (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
- (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
- (CVE-2026-111497) src: expose
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) – High - (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
- (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
- (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
- deps: V8: backport 93cd21e8254b (Joyee Cheung)
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- tls: reject chains containing blocked public keys (Ulises Gascon)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
- crypto: harden X.509 conversion and formatting (Filip Skokan)
Commits
- [
818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 - [
fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) [nodejs-private/node-private#966](https://github.com/nodejs-private/node-private/issues/966) - [
acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-private/node-private/issues/987) - [
7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #66721 - [
12daa54d2e] - deps: V8: backport 93cd21e8254b (Joyee Cheung) [nodejs-private/node-private#999](https://github.com/nodejs-private/node-private/issues/999) - [
6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 - [
a6040b50d9] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/issues/1002) - [
6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) [nodejs-private/node-private#984](https://github.com/nodejs-private/node-private/issues/984) - [
0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) [nodejs-private/node-private#983](https://github.com/nodejs-private/node-private/issues/983) - [
e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786 - [
cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) [nodejs-private/node-private#973](https://github.com/nodejs-private/node-private/issues/973) - [
0392385841] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/issues/1002) - [
c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/issues/986) - [
a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871 - [
ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) [nodejs-private/node-private#982](https://github.com/nodejs-private/node-private/issues/982) - [
cd4b05469c] - tls: fix ip normalization regression (James M Snell) [nodejs-private/node-private#985](https://github.com/nodejs-private/node-private/issues/985) - [
5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855 - [
745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) [nodejs-private/node-private#981](https://github.com/nodejs-private/node-private/issues/981)
