精选857月29日 22:00Node.js（GitHub Releases）语言与库

Node.js v22.23.2 安全更新修复多项高危漏洞

2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolito

推荐理由

Node.js LTS 安全更新，修复多个可被外部触发的高危漏洞（http2、权限模块），建议所有生产环境尽快升级至 v22.23.2。

This is a security release.

Notable Changes

(CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
(CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
(CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
(CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
(CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
(CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
(CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
(CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
(CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
(CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
deps: update llhttp to 9.4.3 (Paolo Insogna)
deps: update undici to 6.28.0 (Node.js GitHub Bot)

[4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
[3fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #64714
[22efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
[c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932
[daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
[f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
[51123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934
[acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
[440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
[ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
[0566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
[0d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力