Juan José

2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

This is a security release.

Notable Changes

  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

Windows 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-x64.msi
Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-arm64.msi
Windows 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-x64/node.exe
Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-arm64/node.exe
macOS 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1.pkg
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-arm64.tar.gz
macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-x64.tar.gz
Linux 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-x64.tar.xz
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-ppc64le.tar.xz
Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-s390x.tar.xz
AIX 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-aix-ppc64.tar.gz
ARMv8 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-arm64.tar.xz
Source Code: https://nodejs.org/dist/v24.18.1/node-v24.18.1.tar.gz
Other release files: https://nodejs.org/dist/v24.18.1/
Documentation: https://nodejs.org/docs/v24.18.1/api/

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

3c76240c07b9f03574a5cf8ed8ba19e8db89271943817b1a4b94de43c97a9e66  node-v24.18.1-aix-ppc64.tar.gz
c3897213475a089b526c8ffb5a84b0151d03eb2206d3e38aac44b2c053719b81  node-v24.18.1-arm64.msi
eb02f7fab96d3d67de40c5ec8566096fcb4c2026728787683ae5a97eb612b941  node-v24.18.1-darwin-arm64.tar.gz
1d60b703fe5d7e7072489be8187f430f1a095a658c31e5e1e281331a5873fac3  node-v24.18.1-darwin-arm64.tar.xz
6fb20fceacbb157c2f95825b80df4a454a0f6d81cdcd7bb81eeae9147e0e76ec  node-v24.18.1-darwin-x64.tar.gz
f892c7895720f40d3750bde24f3554242d36f23602b5167b5b73ec4d13938aef  node-v24.18.1-darwin-x64.tar.xz
bee7344a7fc6e3252c4822ca916a50cd6ddda9bb39374d6140a8046d9238fded  node-v24.18.1-headers.tar.gz
38d44792ec2bee82aca52dbe166979a146f5e75e09ee35e0c0b017b8e2db7c48  node-v24.18.1-headers.tar.xz
df224555a083b918e46260cc969838501b9f9a87140c1195e5b9597b56d5dae2  node-v24.18.1-linux-arm64.tar.gz
7201e3a09dc825bac57867c81913e2b8f0ef87d04cb9082af4cda82f6ff3d88c  node-v24.18.1-linux-arm64.tar.xz
4a8c6209ba3a5aea84c40201d896624ed706b9799a6dc54cbd965433a369a3d0  node-v24.18.1-linux-ppc64le.tar.gz
c47812c13862be7f6e71194c434c4d78a99096e72efb9c31a2627437e056d669  node-v24.18.1-linux-ppc64le.tar.xz
62ad850efefa9ab42a3e901d8e0de86d71bf9c8a0c389dabed248f1ec9590c5a  node-v24.18.1-linux-s390x.tar.gz
acf57bd726f35afc2ba8475194e5a8bd532c00e1a3b2436295b2fbdde199d0e9  node-v24.18.1-linux-s390x.tar.xz
9f5eb6ac21845a66c493c91a253b1da32fd684e89e9b7202d4936982336be4ca  node-v24.18.1-linux-x64.tar.gz
d6c664df3f3f61458e8c277585571328522d705166723a7c7823a9253a4d15a0  node-v24.18.1-linux-x64.tar.xz
c2e424f198dab39b5c68e8b06e0cdba9761dca9b5b432941fce6399d6460dabb  node-v24.18.1.pkg
b62cd76de0a0a28dd9ff88580c92344bdeb008f21c1d7479c5d8659cd96ef4e2  node-v24.18.1.tar.gz
86d40d594bbdfcf69009a62fdf43cb19ae72b6cb5822d2bdd8349c5a1b2fa628  node-v24.18.1.tar.xz
8aed98bca9260716236be292807dcb2638827750ba2fbcfc684601a9a6b8ab48  node-v24.18.1-win-arm64.7z
ffbc7d3e1baf6804f7431ff94f19b9a885a650568c93ea4ccb1bb0038f6af825  node-v24.18.1-win-arm64.zip
365ecf84eeefb87a5a4c94f1e54919696cf5581285db4e589e84d46c0e167406  node-v24.18.1-win-x64.7z
ec56b84a7551893ab2324ebdfdc4ab974a63b4781162600b68a1293cc3e53765  node-v24.18.1-win-x64.zip
af4a0651a26f04ac240f00fec872f305547ca2aa56301c41dfd63a29eb2ab836  node-v24.18.1-x64.msi
845fc4ce00780241667f92e8f7a3a679321a655dddb3b610f2d85693b17ddf28  win-arm64/node.exe
7da03c5111815b69bbe63ffd2e51b28cd69eec9f545b7ccb8756efffdbb88dc2  win-arm64/node.lib
86a5fa89be9c19be42864edfbc2721931fa3c5b318c0f5cd7c1b5c0f49c1f259  win-arm64/node_pdb.7z
0e085f6058961484fb7e93a35ccd0b1ff02efed7bfe1387203097614dc9864a2  win-arm64/node_pdb.zip
ac51903c4c111815d52280b1fdcc8da067cbb37e2fe1a765097b85c3292c8582  win-x64/node.exe
589684168a73547ca47cd22d76a4e465ef561abe89fb1b2b23fe35bbe857d505  win-x64/node.lib
50155c3c9afe1c3ce9a57a8763ed421acc72845c2d30f79d93afe73cb65473ef  win-x64/node_pdb.7z
a9970c87747af4ef15524240dc28ebcf64080c7a68e39d2a406b743e438b6a20  win-x64/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQTdeS9Zc8beUsQyy9rHer+gDdvytwUCamomTgAKCRDHer+gDdvy
twyzAQDrLBWmNsaCn+z0wLyVZgHGA4R5wjJcIil2aKvsiiwDgwEAosTcDL1Me9tq
sDclFViJ4DaRM2efOzyjeLKf/qKH+go=
=4N8e
-----END PGP SIGNATURE-----