●Change8

v22.23.2

📦 node-jsView on GitHub →
🐛 10 fixes🔧 8 symbols

Summary

This is a security release that addresses several vulnerabilities across http2, permission, https, dns, zlib, and http modules. It also includes dependency updates for llhttp and undici.

🐛 Bug Fixes

  • http2: retain header memory in session accounting (CVE-2026-56846)
  • http2: defer rst stream while in scope (CVE-2026-56848)
  • permission: avoid granting radix split nodes (CVE-2026-58043)
  • https: distinguish PFX object-array agent keys (CVE-2026-56850)
  • https: bind identity checks to session reuse (CVE-2026-58040)
  • dns: handle large resolveAny address replies (CVE-2026-58042)
  • zlib: throw on out-of-bounds write buffers (CVE-2026-58045)
  • permission: enforce fs write permission for trace events (CVE-2026-56847)
  • permission: check final report output path (CVE-2026-58039)
  • http: reject requests exceeding max header count (CVE-2026-58044)

Affected Symbols

http2permissionhttpsdnszlibhttpllhttpundici