精选857月30日 00:17Node.js（GitHub Releases）语言与库

Node.js v24.18.1 LTS 安全更新：修复多项高危漏洞

2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

原文

发到 X

推荐理由

Node.js 是开发者日常依赖的运行时，本次安全更新修复了多个可被外部触发的高危漏洞（如 http2 内存问题），建议所有 LTS 用户尽快升级至 v24.18.1 以避免潜在攻击。

This is a security release.

Notable Changes

(CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
(CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
(CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
(CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
(CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
(CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
(CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
(CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
(CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
(CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
(CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
deps: update llhttp to 9.4.3 (Paolo Insogna)
deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

[6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
[bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #64713
[9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
[8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
[a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
[34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
[95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
[fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
[ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
[9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
[6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
[af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
[05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

更进一步：量化金融体系

看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力

进入量化体系 →

话题#安全 #Node.js #LTS #CVE