Node.js v26.12.1 安全发布：修复 tls/dns/http 多项高危漏洞
2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS
推荐理由
本次为含多个高危 CVE 的安全修复版本，涉及网络与 DNS 核心组件，建议所有 Node.js 用户尽快升级以防范可利用漏洞。
This is a security release.
这是一个安全版本。
Notable Changes
重要变更
- (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
- (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
- (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
- (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
- (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
- deps: V8: backport 93cd21e8254b (Joyee Cheung)
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- tls: reject chains containing blocked public keys (Ulises Gascon)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
- crypto: harden X.509 conversion and formatting (Filip Skokan)
- (CVE-2026-106069, CVE-2026-106072) tls：拒绝非规范 IP 地址 (Matteo Collina) – 高危
- (CVE-2026-105482) dns：验证 resolve 输入中的空字节 (James M Snell) – 高危
- (CVE-2026-105483) tls：修复 IP 规范化回归问题 (James M Snell) – 高危
- (CVE-2026-111497) src：暴露 BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – 高危
- (CVE-2026-111497) deps：brotli：cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – 高危
- (CVE-2026-105481) http：确保 agent 数据保护在无 I/O 时正常工作 (James M Snell) – 中危
- (CVE-2026-106074) crypto：在快照间重置随机缓存 (Filip Skokan) – 中危
- (CVE-2026-106070) zlib：避免缓存无效的 ZIP 本地头 (Matteo Collina) – 低危
- (CVE-2026-106071) src：修复通配符节点上的 fs 权限树节点 (James M Snell) – 低危
- (CVE-2026-106073) permission：在 realpathSync 中检查权限模型 (RafaelGSS) – 低危
- deps：V8：backport 93cd21e8254b (Joyee Cheung)
- crypto：将根证书更新为 NSS 3.131.1 (Antoine du Hamel)
- tls：拒绝包含被阻止公钥的证书链 (Ulises Gascon)
- deps：将 c-ares 更新至 1.34.9 (Node.js GitHub Bot)
- tools：在公证后重试 Gatekeeper 检查和 stapling (Ryan Aslett)
- crypto：强化 X.509 转换和格式化 (Filip Skokan)
Commits
提交记录
- [818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
- [fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
- [acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
- [7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #66721
- [12daa54d2e] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#999
- [6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
- [a6040b50d9] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
- [6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
- [0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
- [e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786
- [cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
- [0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
- [c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
- [a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
- [ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
- [cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
- [5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
- [745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981
- [818e4ca061] - crypto：将根证书更新为 NSS 3.131.1 (Antoine du Hamel) #66877
- [fd3c87ed43] - crypto：强化 X.509 转换和格式化 (Filip Skokan) nodejs-private/node-private#966
- [acffa610db] - crypto：在快照间重置随机缓存 (Filip Skokan) nodejs-private/node-private#987
- [7895a5cd2d] - deps：将 undici 更新至 8.12.2 (Node.js GitHub Bot) #66721
- [12daa54d2e] - deps：V8：backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#999
- [6a8b3db7e2] - deps: 将 c-ares 更新到 1.34.9 (Node.js GitHub Bot) #66868
- [a6040b50d9] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
- [6b78ea171d] - dns: 验证 resolve 输入中的空字节 (James M Snell) nodejs-private/node-private#984
- [0683ee5f7d] - http: 确保 agent 数据守卫在无需 I/O 的情况下正常工作 (James M Snell) nodejs-private/node-private#983
- [e5cae10148] - Revert "module: 同步加载大多数 ES 模块" (Antoine du Hamel) #66786
- [cc244131aa] - permission: 在 realpathSync 中检查权限模型 (RafaelGSS) nodejs-private/node-private#973
- [0392385841] - src: 暴露 BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
- [c273a408c9] - src: 修复通配符节点上的 fs 权限树节点 (James M Snell) nodejs-private/node-private#986
- [a2caddd20e] - tls: 拒绝包含被阻止公钥的证书链 (Ulises Gascon) #66871
- [ad788ccd07] - tls: 拒绝非规范 IP 地址 (Matteo Collina) nodejs-private/node-private#982
- [cd4b05469c] - tls: 修复 IP 规范化回归问题 (James M Snell) nodejs-private/node-private#985
- [5fa440e0d7] - tools: 在公证后重试 Gatekeeper 检查和 stapling (Ryan Aslett) #66855
- [745ad77156] - zlib: 避免缓存无效的 ZIP 本地头 (Matteo Collina) nodejs-private/node-private#981
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力