Skip to content

Releases: roshangautam07/node-lts-afterlife

Release list

Node.js v20.20.3 (unofficial EOL security release)

Node.js v20.20.3 (unofficial EOL security release) Latest
Latest

Choose a tag to compare

View all tags
@roshangautam07 roshangautam07 released this 25 Oct 16:46
v20.20.3
5926cf2

Unofficial security release of Node.js 20 'Iron' made after its upstream end-of-life, based on v20.20.2. Not built or endorsed by the Node.js project.

It backports the fixes from every Node.js security release published since then. See SECURITY-STATUS.md for the per-CVE status, and patches/v20.x for the source.

Notable changes

  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS)
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina)
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina)
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina)
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina)
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina)
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS)
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina)
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan)
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina)
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS)
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina)
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS)
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS)
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina)
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS)
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS)
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina)
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS)
  • (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
  • (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
  • (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
  • (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
  • (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
  • (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
  • (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
  • deps: update llhttp to 9.4.1 (Node.js GitHub Bot)
  • deps: update llhttp to 9.4.2 (Antoine du Hamel)
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 6.27.0 (aduh95)
  • deps: update undici to 6.28.0 (Node.js GitHub Bot)
  • deps: update undici to 6.28.1 (mcollina)
  • deps: update undici to 6.29.1 (Node.js GitHub Bot)
  • deps: update c-ares to 1.34.8 (Node.js GitHub Bot)
  • deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
  • deps: update nghttp2 to 1.69.0 (Roshan Gautam)
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry)
  • tls: reject chains containing blocked public keys (Ulises Gascon)
  • deps: upgrade openssl sources to openssl-3.0.22 (Roshan Gautam)
  • deps: update archs files for openssl-3.0.22 (Roshan Gautam)

Downloads

Platform File
Linux x64 (glibc ≥ 2.31) node-v20.20.3-linux-x64.tar.xz
Linux arm64 (glibc ≥ 2.31) node-v20.20.3-linux-arm64.tar.xz
macOS Apple Silicon node-v20.20.3-darwin-arm64.tar.xz

.tar.gz variants are also attached. Verify downloads with shasum -a 256 -c SHASUMS256.txt --ignore-missing.

Install with nvm

tar -xJf node-v20.20.3-linux-x64.tar.xz -C ~/.nvm/versions/node/
mv ~/.nvm/versions/node/node-v20.20.3-linux-x64 ~/.nvm/versions/node/v20.20.3
nvm use 20.20.3

macOS builds are not notarized. If Gatekeeper blocks them, run xattr -dr com.apple.quarantine node-v20.20.3-darwin-arm64.

Verification

These binaries were built outside CI and have no build attestation. You can rebuild them from the same patches with the Build release workflow. scripts/verify-provenance.sh v20 compares every patch with its upstream commit, and scripts/verify.sh v20 runs the fixes' regression tests against any binary.

Assets 9
Loading

Node.js v18.20.9 (unofficial EOL security release)

Node.js v18.20.9 (unofficial EOL security release)

Choose a tag to compare

View all tags
@roshangautam07 roshangautam07 released this 25 Oct 16:45
v18.20.9
5926cf2

Unofficial security release of Node.js 18 'Hydrogen' made after its upstream end-of-life, based on v18.20.8. Not built or endorsed by the Node.js project.

It backports the fixes from every Node.js security release published since then. See SECURITY-STATUS.md for the per-CVE status, and patches/v18.x for the source.

Notable changes

  • (CVE-2025-23167) deps: update llhttp to 9.4.3 (Roshan Gautam)
  • (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS)
  • (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS)
  • (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina)
  • (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS)
  • (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina)
  • (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич)
  • (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina)
  • (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan)
  • (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS)
  • (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina)
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina)
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina)
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina)
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina)
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina)
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina)
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan)
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina)
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina)
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS)
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina)
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS)
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina)
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS)
  • (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
  • (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
  • (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
  • (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
  • (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
  • (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
  • deps: update nghttp2 to 1.69.0 (Roshan Gautam)
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry)
  • tls: reject chains containing blocked public keys (Ulises Gascon)
  • deps: update undici to 6.29.1 (Roshan Gautam)
  • deps: update c-ares to 1.34.9 (Roshan Gautam)
  • deps: update OpenSSL to 3.0.22 (Roshan Gautam)
  • (CVE-2026-21717) deps,build,test: fix array index hash collision (Roshan Gautam)

Downloads

Platform File
Linux x64 (glibc ≥ 2.31) node-v18.20.9-linux-x64.tar.xz
Linux arm64 (glibc ≥ 2.31) node-v18.20.9-linux-arm64.tar.xz
macOS Apple Silicon node-v18.20.9-darwin-arm64.tar.xz

.tar.gz variants are also attached. Verify downloads with shasum -a 256 -c SHASUMS256.txt --ignore-missing.

Install with nvm

tar -xJf node-v18.20.9-linux-x64.tar.xz -C ~/.nvm/versions/node/
mv ~/.nvm/versions/node/node-v18.20.9-linux-x64 ~/.nvm/versions/node/v18.20.9
nvm use 18.20.9

macOS builds are not notarized. If Gatekeeper blocks them, run xattr -dr com.apple.quarantine node-v18.20.9-darwin-arm64.

Verification

These binaries were built outside CI and have no build attestation. You can rebuild them from the same patches with the Build release workflow. scripts/verify-provenance.sh v18 compares every patch with its upstream commit, and scripts/verify.sh v18 runs the fixes' regression tests against any binary.

Loading