Node.js v20 Release Notes

2026-08-03, Version v20.20.4 'Iron' (NES)

This release includes llhttp and undici updates.

• CVE-2026-58045 A flaw in Node.js zlib bindings failed to validate spoofed buffer length properties, allowing out-of-bounds reads and writes when compressing or decompressing data. - (High)
• CVE-2026-58044 A flaw in Node.js HTTP parser allowed the per-connection header count tracking to overflow, bypassing maxHeadersCount and enabling clients to send an unbounded number of headers. - (Medium)
• CVE-2026-58043 A flaw in the Node.js Permission Model's filesystem radix trie can incorrectly grant read or write access to paths that were not covered by --allow-fs-read/--allow-fs-write after a prefix node is split. - (High)
• CVE-2026-58042 A flaw in Node.js DNS resolver can cause an out-of-bounds read when parsing a resolveAny reply that contains a malicious answer count, leading to a crash. - (High)
• CVE-2026-58040 A flaw in Node.js HTTPS Agent can allow a connection using a custom checkServerIdentity callback to be reused for another request that lacked such validation, bypassing certificate identity checks. - (High)
• CVE-2026-58039 A flaw in Node.js process.report.writeReport() failed to account for the configured report directory when checking fs.write permission, allowing the Permission Model to be bypassed. - (Medium)
• CVE-2026-56850 A flaw in Node.js HTTPS Agent connection pooling failed to distinguish agents configured with array-of-object pfx values, causing sockets to be incorrectly reused across different client certificates. - (Medium)
• CVE-2026-56848 A flaw in Node.js HTTP/2 could cause a reentrant call into nghttp2 when purging pending data for a refused stream, leading to closed streams still being accessed and a process crash. - (Medium)
• CVE-2026-56847 A flaw in Node.js trace events API did not enforce the fs.write Permission Model check before writing the trace log file, allowing writes outside the allowed paths. - (Medium)
• CVE-2026-56846 A flaw in Node.js HTTP/2 maxSessionMemory accounting released header block memory as soon as a HEADERS frame was processed, even though JavaScript could keep the header objects alive for the life of the stream, allowing memory exhaustion. - (Medium)

2026-06-25, Version v20.20.3 'Iron' (NES)

This release includes llhttp, nghttp2, undici, npm, minimatch and timezone updates.

• CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB. - (High)
• CVE-2026-48934 A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. - (Medium)
• CVE-2026-48931 A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is sent before the client has sent the request. - (Low)
• CVE-2026-48935 A flaw in Node.js Permission API can cause file metadata to be modified even on a path that was set as read-only with --allow-fs-read. - (Low)
• CVE-2026-48930 A flaw in Node.js TLS hostname handling — embedded NUL hostnames can lead to silent authority rebinding due to C-string truncation in resolver bindings. - (Medium)
• CVE-2026-48928 An inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. - (Medium)
• CVE-2026-48618 A flaw in Node.js TLS hostname handling — unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch. - (High)
• CVE-2026-48617 A flaw in Node.js Permission Model enforcement allows bypass via process.report.writeReport() path misvalidation. - (Low)
• CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. - (Medium)