2026-04-15, Version 24.15.0 'Krypton' (LTS), @aduh95
2026-04-17T08:52:01Z•e7e890150ec10d01e8e3d6f3ff5e98731f9c72aed6162b4811b29cea9a2d85a7
CVELTScryptocurrentfshash-collisionheadershmachttp2kmacnghttp2nodejspermissionsrealpathreleasesecuritysnicallbacktlsweb-crypto
What happened
Multiple Node.js releases in March–April 2026. Security releases (published 2026-03-24) were issued for current and LTS branches (notably v25.8.2, v24.14.1, v22.22.2, v20.20.2) addressing a set of vulnerabilities including two high-severity issues: CVE-2026-21637 (wrap SNICallback invocation in try/catch) and CVE-2026-21710 (use null prototype for headersDistinct/trailersDistinct). Other fixes (medium/low) cover permission checks (pipe_wrap.cc, lib/fs/promises, realpath.native), URL parsing crash handling, timing-safe comparisons in Web Crypto HMAC/KMAC, NGHTTP2 flow-control handling, and an (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- nodejs_node_releases
- Record identifier
- e7e890150ec10d01e8e3d6f3ff5e98731f9c72aed6162b4811b29cea9a2d85a7
- Enrichment time
- 2026-04-17T08:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.