跳到主内容
@wquguru
精选88Node.js（GitHub Releases）语言与库

Node.js v24.22.3 LTS 发布：修复 TLS 远程崩溃与 HTTP/2 多项高危漏洞

2026-11-11, Version 24.22.3 'Krypton' (LTS), @aduh95

原文
发到 X
推荐理由

本次为包含可利用远程崩溃（DoS）及协议绕过风险的安全更新，强烈建议所有运行 Node.js 的服务端环境立即升级至 v24.22.3 以消除隐患。

This is a security release.

这是一个安全版本。

Notable Changes

重要变更

  • (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
  • (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
  • (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
  • (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
  • (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
  • (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
  • (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
  • (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
  • (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
  • (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
  • (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
  • (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
  • (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
  • (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
  • (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
  • (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
  • deps: update brotli to 1.2.1 (Node.js GitHub Bot)
  • deps: update llhttp to 9.4.4 (Antoine du Hamel)
  • deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
  • deps: update undici to 7.30.2 (Node.js GitHub Bot)
  • (CVE-2026-123863) http2: 在流被移除时释放响应头 (Matteo Collina) – 高危
  • (CVE-2026-123864) tls,http: 防止空写入导致的嵌套解析器执行 (Matteo Collina) – 高危
  • (CVE-2026-123865) http2: 检测由 nghttp2 放弃的流 (Matteo Collina) – 高危
  • (CVE-2026-123866) http2: 保留缓冲区直到 socket 写入完成 (Matteo Collina) – 高危
  • (CVE-2026-123872) tls: 禁用无会话 ID 上下文的 mTLS 恢复 (Tim Perry) – 高危
  • (CVE-2026-123872) tls: 不允许重新协商或 HRR 更改 SNI (Tim Perry) – 高危
  • (CVE-2026-123872) tls: 不允许 TLS 恢复更改 SNI (Tim Perry) – 高危
  • (CVE-2026-123874) http2: 在挂起的写入期间保留流 (Matteo Collina) – 高危
  • (CVE-2026-126051) tls: 修复可远程触发的 TLS 服务器崩溃 (Tim Perry) – 高危
  • (CVE-2026-123828) http2: 避免 ALTSVC 缓冲区溢出 (Matteo Collina) – 中危
  • (CVE-2026-123867) tls: 对没有证书的 SNI 上下文应用 CA (Matteo Collina) – 中危
  • (CVE-2026-123868) http2: 将流保留的入站 DATA 计入 maxSessionMemory (Matteo Collina) – 中危
  • (CVE-2026-123871) http: 在无效代理 URL 错误中隐藏代理凭据 (Matteo Collina) – 中危
  • (CVE-2026-123875) http2: 防范已取消流上的空写入请求 (Matteo Collina) – 中危
  • (CVE-2026-123877) https: 隔离 Agent TLS 策略密钥 (Matteo Collina) – 中危
  • (CVE-2026-123829) permission: 在递归 fs.watch 中不泄露被拒绝的子项 (RafaelGSS) – 低危
  • (CVE-2026-123862) zlib: 在 destroy 后处理参数回调 (Matteo Collina) – 低危
  • (CVE-2026-123873) permission: 检查堆快照目标位置 (RafaelGSS) – 低危
  • deps: 更新 brotli 至 1.2.1 (Node.js GitHub Bot)
  • deps: 更新 llhttp 至 9.4.4 (Antoine du Hamel)
  • deps: 更新 sqlite 至 3.54.1 (Node.js GitHub Bot)
  • deps: 更新 undici 至 7.30.2 (Node.js GitHub Bot)

Commits

提交

  • [4c12b8a775] - build: respect OpenSSL's configured API level (Filip Skokan) #66953
  • [5654932a7d] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
  • [e88009c61c] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
  • [92e8d82e0e] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
  • [4164b5c2b4] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990
  • [4fec855b1d] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
  • [17c9eb75f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
  • [57ebbdc275] - deps: update undici to 7.30.2 (Node.js GitHub Bot) #67273
  • [8749030ae5] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
  • [8e100ac90a] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
  • [03f040685b] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
  • [7be19aa614] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
  • [ff8938913b] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
  • [ae9ab37d62] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
  • [a081fd3a3e] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
  • [22f4367981] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
  • [4f60230182] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
  • [fdbc6ab7ac] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
  • [d13a284de6] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
  • [c3485f2417] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
  • [599ca08e28] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
  • [981d2defc6] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
  • [799abe55cb] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
  • [45e3b1637a] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
  • [25d487e3da] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
  • [e14e27b8d3] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037
  • [4c12b8a775] - build: 遵循 OpenSSL 配置的 API 级别 (Filip Skokan) #66953
  • [5654932a7d] - crypto: 修复与旧版 OpenSSL 3.0 的构建问题 (Filip Skokan) #66931
  • [e88009c61c] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
  • [92e8d82e0e] - deps: 将 llhttp 更新至 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
  • [4164b5c2b4] - deps: 将 brotli 更新至 1.2.1 (Node.js GitHub Bot) #66990
  • [4fec855b1d] - deps: 将 sqlite 更新至 3.54.1 (Node.js GitHub Bot) #66816
  • [17c9eb75f3] - deps: 将 sqlite 更新至 3.54.0 (Node.js GitHub Bot) #66663
  • [57ebbdc275] - deps: 将 undici 更新至 7.30.2 (Node.js GitHub Bot) #67273
  • [8749030ae5] - http: 在无效代理 URL 错误中隐藏代理凭据 (Matteo Collina) nodejs-private/node-private#1001
  • [8e100ac90a] - http2: 在挂起的写入期间保留流 (Matteo Collina) nodejs-private/node-private#1040
  • [03f040685b] - http2: 将由流保留的入站 DATA 计入 maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
  • [7be19aa614] - http2: 在套接字写入完成之前保留缓冲区 (Matteo Collina) nodejs-private/node-private#1017
  • [ff8938913b] - http2: 当流被移除时释放头部信息 (Matteo Collina) nodejs-private/node-private#1026
  • [ae9ab37d62] - http2: 避免 ALTSVC 缓冲区溢出 (Matteo Collina) nodejs-private/node-private#1035
  • [a081fd3a3e] - http2: 检测由 nghttp2 放弃的流 (Matteo Collina) #66641
  • [22f4367981] - http2: 防止在被取消的流上出现空写入请求 (Matteo Collina) #67252
  • [4f60230182] - https: 隔离 Agent TLS 策略密钥 (Matteo Collina) nodejs-private/node-private#1036
  • [fdbc6ab7ac] - permission: 在递归 fs.watch 中不泄露被拒绝的后代节点 (RafaelGSS) nodejs-private/node-private#967
  • [d13a284de6] - src: 修复通配符节点上的 fs 权限树节点 (James M Snell) nodejs-private/node-private#986
  • [c3485f2417] - tls: 修复可远程触发的 TLS 服务器崩溃 (Tim Perry) nodejs-private/node-private#1018
  • [599ca08e28] - tls: 禁用无会话 ID 上下文的 mTLS 恢复功能 (Tim Perry) nodejs-private/node-private#1030
  • [981d2defc6] - tls: 不允许重新协商或 HRR 更改 SNI (Tim Perry) nodejs-private/node-private#1030
  • [799abe55cb] - tls: 不允许 TLS 恢复更改 SNI (Tim Perry) nodejs-private/node-private#1030
  • [45e3b1637a] - tls: 应用没有证书的 SNI 上下文的 CA（Matteo Collina）nodejs-private/node-private#1020
  • [25d487e3da] - tls,http: 防止空写入导致的嵌套解析器执行（Matteo Collina）nodejs-private/node-private#1021
  • [e14e27b8d3] - zlib: 在 destroy 后处理参数回调（Matteo Collina）nodejs-private/node-private#1037

更进一步：量化金融体系

看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力

进入量化体系 →
话题#安全#Node.js#LTS

关联讨论

同一事件的更多信源
Node.js 2026年11月安全版本发布
oss-security（开源安全披露）原文

相似阅读

关联信息，但可能不是同一事件