2026-03-24, Version 25.8.2 (Current), @RafaelGSS
2026-03-31T08:52:03Z•dad238601f380bb96be829dc476e263052fd0d7fc9135b29e549094ab593a72f
CVEHMACHTTP/2KMACTLS/SNIWebCryptofilesystem-permissionshash-collisionnodejsprototype-pollution-mitigationreleasesecurityurl-parsing
What happened
Node.js security releases published 2026-03-24 for multiple lines (v25.8.2 Current; v24.14.1, v22.22.2, v20.20.2 LTS). Fixes address multiple vulnerabilities including two High severity issues (wrapping SNICallback in try/catch to avoid crashes and using a null prototype for headersDistinct/trailersDistinct), plus several Medium/Low fixes: timing‑safe comparisons for WebCrypto HMAC/KMAC, NGHTTP2 flow‑control error handling, URL parsing crash fixes, array index hash‑collision mitigation, and added permission checks in filesystem and native APIs.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- nodejs_node_releases
- Record identifier
- dad238601f380bb96be829dc476e263052fd0d7fc9135b29e549094ab593a72f
- Enrichment time
- 2026-03-31T08:52:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.