node-linux-s390x 22.23.4 → 22.23.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +49 -0
  2. package/bin/node +2 -2
  3. package/include/node/node_version.h +1 -1
  4. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -9,6 +9,7 @@
9
9
  </tr>
10
10
  <tr>
11
11
  <td>
12
+ <a href="#22.23.5">22.23.5</a><br/>
12
13
  <a href="#22.23.4">22.23.4</a><br/>
13
14
  <a href="#22.23.3">22.23.3</a><br/>
14
15
  <a href="#22.23.2">22.23.2</a><br/>
@@ -76,6 +77,54 @@
76
77
  * [io.js](CHANGELOG_IOJS.md)
77
78
  * [Archive](CHANGELOG_ARCHIVE.md)
78
79
 
80
+ <a id="22.23.5"></a>
81
+
82
+ ## 2026-11-11, Version 22.23.5 'Jod' (LTS), @aduh95
83
+
84
+ This is a security release.
85
+
86
+ ### Notable Changes
87
+
88
+ * (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
89
+ * (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
90
+ * (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
91
+ * (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
92
+ * (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
93
+ * (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
94
+ * (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
95
+ * (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
96
+ * (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
97
+ * (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
98
+ * (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
99
+ * (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
100
+ * (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
101
+ * (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
102
+ * (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
103
+ * (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
104
+ * (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
105
+ * deps: update llhttp to 9.4.4 (Antoine du Hamel)
106
+ * deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
107
+
108
+ ### Commits
109
+
110
+ * \[[`554fff40f0`](https://github.com/nodejs/node/commit/554fff40f0)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038)
111
+ * \[[`6577cbf231`](https://github.com/nodejs/node/commit/6577cbf231)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#66816](https://github.com/nodejs/node/pull/66816)
112
+ * \[[`61d93c6086`](https://github.com/nodejs/node/commit/61d93c6086)] - **deps**: update sqlite to 3.54.0 (Node.js GitHub Bot) [#66663](https://github.com/nodejs/node/pull/66663)
113
+ * \[[`cd18f6bdff`](https://github.com/nodejs/node/commit/cd18f6bdff)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001)
114
+ * \[[`6cd7e80d68`](https://github.com/nodejs/node/commit/6cd7e80d68)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017)
115
+ * \[[`9bce421783`](https://github.com/nodejs/node/commit/9bce421783)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026)
116
+ * \[[`30fd852c0d`](https://github.com/nodejs/node/commit/30fd852c0d)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#66641](https://github.com/nodejs/node/pull/66641)
117
+ * \[[`21fb5d0348`](https://github.com/nodejs/node/commit/21fb5d0348)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#67252](https://github.com/nodejs/node/pull/67252)
118
+ * \[[`af6fbb6564`](https://github.com/nodejs/node/commit/af6fbb6564)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036)
119
+ * \[[`5c9eed3b1e`](https://github.com/nodejs/node/commit/5c9eed3b1e)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967)
120
+ * \[[`5e497aec89`](https://github.com/nodejs/node/commit/5e497aec89)] - **src**: fix the fs permission tree node on wildcard nodes (James M Snell) [nodejs-private/node-private#986](https://github.com/nodejs-private/node-private/pull/986)
121
+ * \[[`06af164d09`](https://github.com/nodejs/node/commit/06af164d09)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
122
+ * \[[`209c7e4d83`](https://github.com/nodejs/node/commit/209c7e4d83)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
123
+ * \[[`05e452f075`](https://github.com/nodejs/node/commit/05e452f075)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030)
124
+ * \[[`67da864a89`](https://github.com/nodejs/node/commit/67da864a89)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020)
125
+ * \[[`c841c6c7f1`](https://github.com/nodejs/node/commit/c841c6c7f1)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021)
126
+ * \[[`ea159e84dd`](https://github.com/nodejs/node/commit/ea159e84dd)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037)
127
+
79
128
  <a id="22.23.4"></a>
80
129
 
81
130
  ## 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95
package/bin/node CHANGED
@@ -1,4 +1,4 @@
1
1
  [diffend] Oversized file quarantined before diffing.
2
2
  name: package/bin/node
3
- size: 127021568 bytes
4
- sha256: 128efa7f408301bb93db955201402ad1fb779d33033caf9e1b0487f904039e61
3
+ size: 127064816 bytes
4
+ sha256: 82e510ddaf8c9b71e2315555d26045f92b4f36500f0471edb3169db34ea6846b
package/include/node/node_version.h CHANGED
@@ -24,7 +24,7 @@
24
24
 
25
25
  #define NODE_MAJOR_VERSION 22
26
26
  #define NODE_MINOR_VERSION 23
27
- #define NODE_PATCH_VERSION 4
27
+ #define NODE_PATCH_VERSION 5
28
28
 
29
29
  #define NODE_VERSION_IS_LTS 1
30
30
  #define NODE_VERSION_LTS_CODENAME "Jod"
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "node-linux-s390x",
3
- "version": "22.23.4",
3
+ "version": "22.23.5",
4
4
  "description": "node",
5
5
  "repository": {
6
6
  "url": "git+https://github.com/aredridel/node-bin-gen.git"