http2

This release addresses multiple security vulnerabilities across various components including URL normalization, HTTP/3, HTTP/2, admin, ext_authz, and QUIC. It also includes several bug fixes for filter management, ext_proc, and router functionalities.

This release focuses heavily on security fixes, addressing vulnerabilities in HTTP/2 header limits, HMAC verification, and AES-CBC decryption. It also includes several bug fixes and minor behavior changes regarding upstream failure reasons and load balancer rebuild coalescing.

Release v1.37.3 includes several security fixes related to HTTP/2 header limits, HMAC verification, and AES-CBC decryption, alongside a fix for a load report shutdown race condition.

This release focuses on security fixes, addressing vulnerabilities in HTTP/2 header limits and OAuth2 HMAC verification, alongside a fix for a load report shutdown race condition.

This release focuses heavily on security fixes, addressing vulnerabilities in HTTP/2 header limits, HMAC verification, and AES-CBC decryption. It also introduces new features for periodic metric eviction and limiting stats scope size.

This is a security release addressing multiple vulnerabilities across http2, permission, https, sqlite, dns, zlib, and http modules. It also includes dependency updates for llhttp and undici.

This is a security release addressing multiple vulnerabilities across various modules including http2, permission, https, sqlite, dns, zlib, and http. It also includes dependency updates for llhttp and undici.

This is a security release that addresses several vulnerabilities across http2, permission, https, dns, zlib, and http modules. It also includes dependency updates for llhttp and undici.

This is a security release addressing multiple high and medium severity vulnerabilities across TLS, crypto, HTTP/2, DNS, and permission handling modules. Key fixes involve input validation and boundary checks to prevent potential exploits.

This is a security release addressing multiple high and medium severity CVEs across TLS, crypto, HTTP/2, and DNS modules. It also includes dependency upgrades for nghttp2, llhttp, openssl, and undici.

This is a security release addressing multiple high and medium severity CVEs across TLS, crypto, HTTP/2, and DNS modules. It also includes dependency updates and removes deprecated http2 priority signaling.

This release introduces several new features across CLI, crypto, fs, and stream modules, stabilizes ESM require and module caching, and includes numerous performance improvements and bug fixes across core modules.

This release introduces HTTP/1 fallback configuration for http2, supports ESM entry points in SEA, and marks the sqlite module as a release candidate. It also includes several documentation improvements and dependency updates.

This release focuses on security updates including root certificate renewals and OpenSSL 3.0.17, alongside the deprecation of HTTP/2 priority signaling and various dependency bumps.

This release focuses on performance optimizations for array inspection and HTTP/2, along with critical bug fixes for process execution environment variables and async context handling during unhandled rejections.

This release introduces the fileURLToPathBuffer API, object property mocking in the test runner, and stabilizes type stripping by removing its experimental warning. It also includes significant dependency updates and reverts changes to test_runner promises.

This security release addresses three medium-severity vulnerabilities (CVE-2025-23085, CVE-2025-23084, CVE-2025-22150) involving HTTP2 memory leaks, Windows path traversal, and undici fetch randomness.

This security release addresses several vulnerabilities including a high-severity issue in the Permission Model, path traversal on Windows, and memory leaks in HTTP/2.

This security release addresses critical vulnerabilities including a path traversal on Windows, an HTTP/2 memory leak, and unauthorized InternalWorker access when the permission model is active.

Security release addressing multiple CVEs including path traversal on Windows, HTTP/2 memory leaks, and permission model bypasses.

This release introduces new features like HMR for React Router and enhanced buffer manipulation in Node.js extensions, alongside numerous bug fixes across various modules including desktop, core, and npm operations.

This release introduces significant enhancements to Node.js compatibility, including rewriting node:http with llhttp and implementing the node:repl module. Numerous bug fixes address issues across HTTP/2, TLS, file system operations, and runtime stability.

This release fixes socket hang‑up issues for keep‑alive requests with timeouts, adds default export support for the http2 module, and improves HTTP loop performance.