24.22.1

This is a security release.

Notable Changes

• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
• (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
• (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• deps: update timezone to 2026e (Node.js GitHub Bot)
• deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
• deps: update undici to 7.30.1 (Node.js GitHub Bot)

Commits

• [2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
• [4d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [4b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007
• [9243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
• [1e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
• [49dff6f57a] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [fca511adc5] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008
• [18711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
• [fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
• [b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
• [ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
• [1d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #66764
• [843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [96c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [8dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [b5f41529df] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [01acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #66871
• [935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
• [9dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855