node-bin-darwin-arm64 26.5.0 → 26.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +37 -0
  2. package/bin/node +0 -0
  3. package/include/node/node_version.h +1 -1
  4. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -8,6 +8,7 @@
8
8
  </tr>
9
9
  <tr>
10
10
  <td>
11
+ <a href="#26.5.1">26.5.1</a><br/>
11
12
  <a href="#26.5.0">26.5.0</a><br/>
12
13
  <a href="#26.4.0">26.4.0</a><br/>
13
14
  <a href="#26.3.1">26.3.1</a><br/>
@@ -47,6 +48,42 @@
47
48
  * [io.js](CHANGELOG_IOJS.md)
48
49
  * [Archive](CHANGELOG_ARCHIVE.md)
49
50
 
51
+ <a id="26.5.1"></a>
52
+
53
+ ## 2026-07-29, Version 26.5.1 (Current), @RafaelGSS
54
+
55
+ This is a security release.
56
+
57
+ ### Notable Changes
58
+
59
+ * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
60
+ * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
61
+ * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
62
+ * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
63
+ * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
64
+ * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
65
+ * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
66
+ * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
67
+ * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
68
+ * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
69
+ * deps: update llhttp to 9.4.3 (Paolo Insogna)
70
+ * deps: update undici to 8.9.0 (Node.js GitHub Bot)
71
+
72
+ ### Commits
73
+
74
+ * \[[`af0bf96877`](https://github.com/nodejs/node/commit/af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
75
+ * \[[`0354678355`](https://github.com/nodejs/node/commit/0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](https://github.com/nodejs/node/pull/64712)
76
+ * \[[`dbeeaeec13`](https://github.com/nodejs/node/commit/dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
77
+ * \[[`064d339f56`](https://github.com/nodejs/node/commit/064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
78
+ * \[[`23b94c843a`](https://github.com/nodejs/node/commit/23b94c843a)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
79
+ * \[[`c7ec3dc0b9`](https://github.com/nodejs/node/commit/c7ec3dc0b9)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904)
80
+ * \[[`8f666925b1`](https://github.com/nodejs/node/commit/8f666925b1)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
81
+ * \[[`ad99d075b1`](https://github.com/nodejs/node/commit/ad99d075b1)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
82
+ * \[[`61222008b7`](https://github.com/nodejs/node/commit/61222008b7)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#908](https://github.com/nodejs-private/node-private/pull/908)
83
+ * \[[`3cb607dfc4`](https://github.com/nodejs/node/commit/3cb607dfc4)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#924](https://github.com/nodejs-private/node-private/pull/924)
84
+ * \[[`d08fde8a16`](https://github.com/nodejs/node/commit/d08fde8a16)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896)
85
+ * \[[`b3fbb6e11f`](https://github.com/nodejs/node/commit/b3fbb6e11f)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)
86
+
50
87
  <a id="26.5.0"></a>
51
88
 
52
89
  ## 2026-07-08, Version 26.5.0 (Current), @richardlau
package/bin/node CHANGED
Binary file
package/include/node/node_version.h CHANGED
@@ -24,7 +24,7 @@
24
24
 
25
25
  #define NODE_MAJOR_VERSION 26
26
26
  #define NODE_MINOR_VERSION 5
27
- #define NODE_PATCH_VERSION 0
27
+ #define NODE_PATCH_VERSION 1
28
28
 
29
29
  #define NODE_VERSION_IS_LTS 0
30
30
  #define NODE_VERSION_LTS_CODENAME ""
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "node-bin-darwin-arm64",
3
- "version": "26.5.0",
3
+ "version": "26.5.1",
4
4
  "description": "node",
5
5
  "repository": {
6
6
  "url": "git+https://github.com/aredridel/node-bin-gen.git"