●Change8

v26.5.1

📦 node-jsView on GitHub →
🐛 10 fixes🔧 9 symbols

Summary

This is a security release addressing multiple vulnerabilities across various modules including http2, permission, https, sqlite, dns, zlib, and http. It also includes dependency updates for llhttp and undici.

🐛 Bug Fixes

  • (CVE-2026-56848) http2: defer rst stream while in scope.
  • (CVE-2026-58043) permission: avoid granting radix split nodes.
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys.
  • (CVE-2026-58040) https: bind identity checks to session reuse.
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset.
  • (CVE-2026-58042) dns: handle large resolveAny address replies.
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers.
  • (CVE-2026-56847) permission: enforce fs write permission for trace events.
  • (CVE-2026-58039) permission: check final report output path.
  • (CVE-2026-58044) http: reject requests exceeding max header count.

Affected Symbols

http2permissionhttpssqlitednszlibhttpllhttpundici