node-linux-x64 24.18.0 → 24.18.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +39 -0
  2. package/bin/node +0 -0
  3. package/include/node/node_version.h +1 -1
  4. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -9,6 +9,7 @@
9
9
  </tr>
10
10
  <tr>
11
11
  <td>
12
+ <a href="#24.18.1">24.18.1</a><br/>
12
13
  <a href="#24.18.0">24.18.0</a><br/>
13
14
  <a href="#24.17.0">24.17.0</a><br/>
14
15
  <a href="#24.16.0">24.16.0</a><br/>
@@ -66,6 +67,44 @@
66
67
  * [io.js](CHANGELOG_IOJS.md)
67
68
  * [Archive](CHANGELOG_ARCHIVE.md)
68
69
 
70
+ <a id="24.18.1"></a>
71
+
72
+ ## 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol
73
+
74
+ This is a security release.
75
+
76
+ ### Notable Changes
77
+
78
+ * (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
79
+ * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
80
+ * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
81
+ * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
82
+ * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
83
+ * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
84
+ * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
85
+ * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
86
+ * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
87
+ * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
88
+ * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
89
+ * deps: update llhttp to 9.4.3 (Paolo Insogna)
90
+ * deps: update undici to 7.29.0 (Node.js GitHub Bot)
91
+
92
+ ### Commits
93
+
94
+ * \[[`6cb0475751`](https://github.com/nodejs/node/commit/6cb0475751)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
95
+ * \[[`bcfe21d3dc`](https://github.com/nodejs/node/commit/bcfe21d3dc)] - **deps**: update undici to 7.29.0 (Node.js GitHub Bot) [#64713](https://github.com/nodejs/node/pull/64713)
96
+ * \[[`9d0d36cffd`](https://github.com/nodejs/node/commit/9d0d36cffd)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
97
+ * \[[`8a008fb523`](https://github.com/nodejs/node/commit/8a008fb523)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
98
+ * \[[`a77c7f7354`](https://github.com/nodejs/node/commit/a77c7f7354)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
99
+ * \[[`34ed88a069`](https://github.com/nodejs/node/commit/34ed88a069)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#63752](https://github.com/nodejs/node/pull/63752)
100
+ * \[[`95ba2cfde7`](https://github.com/nodejs/node/commit/95ba2cfde7)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904)
101
+ * \[[`fcbdbe47ea`](https://github.com/nodejs/node/commit/fcbdbe47ea)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
102
+ * \[[`ea26c12b56`](https://github.com/nodejs/node/commit/ea26c12b56)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
103
+ * \[[`9a6b7e343a`](https://github.com/nodejs/node/commit/9a6b7e343a)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926)
104
+ * \[[`6c0c990880`](https://github.com/nodejs/node/commit/6c0c990880)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927)
105
+ * \[[`af9ff0490c`](https://github.com/nodejs/node/commit/af9ff0490c)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896)
106
+ * \[[`05f541b5c0`](https://github.com/nodejs/node/commit/05f541b5c0)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)
107
+
69
108
  <a id="24.18.0"></a>
70
109
 
71
110
  ## 2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxa
package/bin/node CHANGED
Binary file
package/include/node/node_version.h CHANGED
@@ -24,7 +24,7 @@
24
24
 
25
25
  #define NODE_MAJOR_VERSION 24
26
26
  #define NODE_MINOR_VERSION 18
27
- #define NODE_PATCH_VERSION 0
27
+ #define NODE_PATCH_VERSION 1
28
28
 
29
29
  #define NODE_VERSION_IS_LTS 1
30
30
  #define NODE_VERSION_LTS_CODENAME "Krypton"
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "node-linux-x64",
3
- "version": "24.18.0",
3
+ "version": "24.18.1",
4
4
  "description": "node",
5
5
  "repository": {
6
6
  "url": "git+https://github.com/aredridel/node-bin-gen.git"