2026-03-24, Version 25.8.2 (Current), @RafaelGSS
2026-03-26T08:52:05Z•b9728ab683eb428ec702a7554129b5224dee44a3101d47ec22939ff2f9c13f8a
CVEHMACKMACLTSSNICallbackarray-indexcryptodenial-of-servicefsfs/promiseshash-collisionheadershttp2nghttp2nodejspermissionsprototyperealpathrelease-notessecurity-releasetiming-attacktlsurl
What happened
Node.js security release (2026-03-24) addressing nine CVEs across multiple active release lines (v25.8.2 current; v24.14.1, v22.22.2, v20.20.2 LTS). High-severity fixes: CVE-2026-21637 (wrap SNICallback in try/catch to avoid unhandled exceptions/crash/DoS) and CVE-2026-21710 (use null prototype for headersDistinct/trailersDistinct to mitigate prototype-based header tampering). Other fixes (medium/low) cover timing-safe comparisons for Web Crypto HMAC/KMAC (CVE-2026-21713), array-index hash collision handling (CVE-2026-21717), NGHTTP2 flow-control error handling (CVE-2026-21714), URL parsing/cr
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- nodejs_node_releases
- Record identifier
- b9728ab683eb428ec702a7554129b5224dee44a3101d47ec22939ff2f9c13f8a
- Enrichment time
- 2026-03-26T08:52:05Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.