HeroDevs
Visit Node NES Home Page

Node.js v20 Release Notes

Comprehensive release notes and changelog for Node.js v20, including security patches, bug fixes, and feature updates across all supported versions.

21 Patched Vulnerabilities
VEX Statements

2026-08-03, Version v20.20.4 'Iron' (NES)

This release includes llhttp and undici updates.

  • CVE-2026-58045 A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the process to crash. Repeated exploitation of this condition can result in a denial of service. - (Medium)
  • CVE-2026-58044 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered. - (Low)
  • CVE-2026-58043 A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse radix-tree prefix boundary handling to read from or write to paths outside the intended filesystem allowlist. - (High)
  • CVE-2026-58042 A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than 256 A records. Repeated triggering of this condition can lead to denial of service. - (Medium)
  • CVE-2026-58040 An incomplete fix for CVE-2026-48934 has been identified in Node.js. HTTPS Agent TLS session reuse can skip hostname verification across identity policies. - (Medium)
  • CVE-2026-58039 A flaw in Node.js Permission Model enforcement allows process.report to write and overwrite files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. - (Low)
  • CVE-2026-56850 A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. - (Medium)
  • CVE-2026-56848 A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. - (High)
  • CVE-2026-56847 A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() to write trace logs outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. - (Low)
  • CVE-2026-56846 A flaw in Node.js HTTP/2 handling can let retained header blocks evade maxSessionMemory limits and cause remote memory exhaustion. - (High)
  • CVE-2026-48937 A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame, leading to uncontrolled resource consumption. - (Medium)

2026-06-25, Version v20.20.3 'Iron' (NES)

This release includes llhttp, nghttp2, undici, npm, minimatch and timezone updates.

  • CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB. - (High)
  • CVE-2026-48934 A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. - (Medium)
  • CVE-2026-48931 A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is sent before the client has sent the request. - (Low)
  • CVE-2026-48935 A flaw in Node.js Permission API can cause file metadata to be modified even on a path that was set as read-only with --allow-fs-read. - (Low)
  • CVE-2026-48930 A flaw in Node.js TLS hostname handling — embedded NUL hostnames can lead to silent authority rebinding due to C-string truncation in resolver bindings. - (Medium)
  • CVE-2026-48928 An inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. - (Medium)
  • CVE-2026-48618 A flaw in Node.js TLS hostname handling — unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch. - (High)
  • CVE-2026-48617 A flaw in Node.js Permission Model enforcement allows bypass via process.report.writeReport() path misvalidation. - (Low)
  • CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. - (Medium)
  • CVE-2026-21713 Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery - (Medium)