From 80744f3840a7af1b7ab1fa3f1eff36d4d84802c8 Mon Sep 17 00:00:00 2001 From: Create or Update Pull Request Action Date: Wed, 29 Jul 2026 14:03:39 +0000 Subject: [PATCH] feat(blog): create post for v26.5.1 --- apps/site/pages/en/blog/release/v26.5.1.md | 111 +++++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 apps/site/pages/en/blog/release/v26.5.1.md diff --git a/apps/site/pages/en/blog/release/v26.5.1.md b/apps/site/pages/en/blog/release/v26.5.1.md new file mode 100644 index 0000000000000..c49f6799f01c3 --- /dev/null +++ b/apps/site/pages/en/blog/release/v26.5.1.md @@ -0,0 +1,111 @@ +--- +date: '2026-07-29T14:03:39.312Z' +category: release +title: Node.js 26.5.1 (Current) +layout: blog-post +author: Rafael Gonzaga +--- + +## 2026-07-29, Version 26.5.1 (Current), @RafaelGSS + +This is a security release. + +### Notable Changes + +- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High +- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High +- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium +- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium +- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium +- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium +- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium +- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low +- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low +- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low +- deps: update llhttp to 9.4.3 (Paolo Insogna) +- deps: update undici to 8.9.0 (Node.js GitHub Bot) + +### Commits + +- \[[`af0bf96877`](https://github.com/nodejs/node/commit/af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) +- \[[`0354678355`](https://github.com/nodejs/node/commit/0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](https://github.com/nodejs/node/pull/64712) +- \[[`dbeeaeec13`](https://github.com/nodejs/node/commit/dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) +- \[[`064d339f56`](https://github.com/nodejs/node/commit/064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) +- \[[`23b94c843a`](https://github.com/nodejs/node/commit/23b94c843a)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921) +- \[[`c7ec3dc0b9`](https://github.com/nodejs/node/commit/c7ec3dc0b9)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904) +- \[[`8f666925b1`](https://github.com/nodejs/node/commit/8f666925b1)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930) +- \[[`ad99d075b1`](https://github.com/nodejs/node/commit/ad99d075b1)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911) +- \[[`61222008b7`](https://github.com/nodejs/node/commit/61222008b7)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#908](https://github.com/nodejs-private/node-private/pull/908) +- \[[`3cb607dfc4`](https://github.com/nodejs/node/commit/3cb607dfc4)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#924](https://github.com/nodejs-private/node-private/pull/924) +- \[[`d08fde8a16`](https://github.com/nodejs/node/commit/d08fde8a16)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896) +- \[[`b3fbb6e11f`](https://github.com/nodejs/node/commit/b3fbb6e11f)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931) + +Windows 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1-arm64.msi \ +Windows 64-bit Binary: https://nodejs.org/dist/v26.5.1/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v26.5.1/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-aix-ppc64.tar.gz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v26.5.1/node-v26.5.1.tar.gz \ +Other release files: https://nodejs.org/dist/v26.5.1/ \ +Documentation: https://nodejs.org/docs/v26.5.1/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +0bafe816b17bcaee285e79e325b7a44eea605d12d81b2caa78cddcadf5d1b5f6 node-v26.5.1-aix-ppc64.tar.gz +01875f52263953ad81972d304263f36a71e5e97873fa9fa60989e8973d18d00b node-v26.5.1-arm64.msi +f4387df0b46556516d19abf2f2d6806481ac8368aa7f9d96bafed422a56a1d01 node-v26.5.1-darwin-arm64.tar.gz +f4665a1e764653ec6fe7686309e8907e9ebb9ba68c4b88b9185fdc29f221559b node-v26.5.1-darwin-arm64.tar.xz +077d5c936868dab19d21f77f1e71ce13697e80b3e86a399dcab238902a2ebf93 node-v26.5.1-darwin-x64.tar.gz +4436be8db0e2bd5ca3dee8c48aa8a157c9a8fef99580036ff1da8ef6aba44708 node-v26.5.1-darwin-x64.tar.xz +598a3139679db65461f8af50463d668008eaee5e0d09df4eeaa27f3eeefecc03 node-v26.5.1-headers.tar.gz +f72d24a5a34b40ba738f6d28cdcd50e3f4976558d4f14bebfa64fdbdcfc4951a node-v26.5.1-headers.tar.xz +21194bbf41c18d9ec277545c4d14cce8597d57a9d9f494c323d8121a25de33e8 node-v26.5.1-linux-arm64.tar.gz +0b6b0cc2a1eecbe736f9918de8b5a6c9a48d286b88bec1298a3c1e3376182ea8 node-v26.5.1-linux-arm64.tar.xz +cf518dd2772ea7e5046daf4a4ba9e348fce01e2b9741f32ba21b4bbd87b8dfaf node-v26.5.1-linux-ppc64le.tar.gz +692d0c45896bf232e22b8b64a4a826ed0a70fec75545f208d120c109d0a86752 node-v26.5.1-linux-ppc64le.tar.xz +af5a58fca0c3fc130c6a649bd6c29f4b000145055eb7a364bde189abdf1516f5 node-v26.5.1-linux-s390x.tar.gz +ff4635062f82308dda7c7164337ad9bb383568dac984ff64b35b888e7d7a4ef3 node-v26.5.1-linux-s390x.tar.xz +2b07f09c218d473a26442bff5a90151f53f7b7c0a23bad244eda2c26303a2ba7 node-v26.5.1-linux-x64.tar.gz +cc7b3484ade63bd203a9d304f21ec37a3b622b988d7bdecf1dc4d68fc44a91b7 node-v26.5.1-linux-x64.tar.xz +a6e6cfdb0af6d7d68b50a6f663b8ff321923089309076ea7943a19dbe5eb662a node-v26.5.1-win-arm64.7z +467f425228a2fdcc83a330f5f38b124b5b43b42f5033d7848b4e47c9becc36f9 node-v26.5.1-win-arm64.zip +0c8a1a3604e57400432089cf7e179eac4f25b26445a156aaa98cca5619e50f5c node-v26.5.1-win-x64.7z +c432c996b95cbf7568f13a0fbb37526de84a27e3a5c520c3be15f05a9a168212 node-v26.5.1-win-x64.zip +826a4551bb9d3c00c61c17a2521a1e901ac7304e3090a3c2d07c1e0fe2b4d60d node-v26.5.1-x64.msi +ae175856e12aadc081a539af37a70a71d3233b2e710fa00266137e23e24faca2 node-v26.5.1.pkg +1143281232fc4640188aaa20afb0f9c4f06031f554cd3f1e5ac86e8a0387511a node-v26.5.1.tar.gz +df7770a9a99346f8b73ba6d31ad89bd6f868b51c7387c3627dcb44ca065f4948 node-v26.5.1.tar.xz +c6ca33154ee426f46e02aa9f5676d69b768808b564aa22652fe18bb08c188fe5 win-arm64/node.exe +c01ce0d5e4e956f0e5e73cdba925d15a6d6f86883aa49f8f0b0de87aa93508ce win-arm64/node.lib +83961c8a59f1771a2e0ffcf89487b3fa0a7ca18a69f1061683c27671b36665e5 win-arm64/node_pdb.7z +7b40fa280b35d3aef700852220075f262a25c4cdd9a6f90fb8a3a4b1bed9cf8b win-arm64/node_pdb.zip +b48b0224081224cda1f49374e2fc63d143041ade51754f0cc6608fe8510ba29e win-x64/node.exe +56f06350037085fce04930befd98327afc86ee46f52af6f6f8a68a03630e8380 win-x64/node.lib +cbd18315c40cb831d1a398c0df64a43876999e77eb56b52589b64ee8a5bf93d0 win-x64/node_pdb.7z +fb3b232e033a25d0aae20c0413589569688807471e98a1620ef7f7ec959fbf83 win-x64/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmpqCAYACgkQi+q0389V +XvRsRwv9Gscq3A1VqXWzAWdyE+tWyMGYTSzisHRRudAmDVkUoEK/WHfgmbmFXXDC +IjokChhRdJL4I3DFSq8sntybzGMYb1hqwvPRr9fRCW+6dsVT1eNnb8OQWObqONaq +w8F82T+mSk8D4ZSH7Q9IMGBZBzln3oRBwXuHOUcYMtnMEKgHsP35Li4HARaKWMGE +enlNvp+r9PxHMKXtKl5cFygqh0slhEHJQ/6GzKKNRbSFTpEBkQbtIEaFib7XHguv +6uUj0R0ZhCXrcYzlxhL6KIGHes0jMIRwkM9C3b7Q2c9Jw0PuglhCPdD+VZI1dIU6 +7j8f/jyncIZMXE5FNnldwMy9aiA/xcOenTEA/F2yBEM+ErrWf8r7tLQk0JfqmZ1M +qfqHHb2zu2ywcHspOS6Lhn+1wE47rEKAdYYt7iRA4L86TASCie1K8hgrsIJE5z5D +dv02pgX3Oj2hLsCun3PfH6a0MSYXIDCwelz3wn8uWl5tN8pH4F0eLZWJ04sjXvdb +ySj7vo4t +=wksr +-----END PGP SIGNATURE----- +```