Skip to content

feat(blog): create post for v26.5.1 #9044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bmuenzenmeyer merged 1 commit into from
Jul 29, 2026
+111 −0
Merged

feat(blog): create post for v26.5.1 #9044

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
111 changes: 111 additions & 0 deletions apps/site/pages/en/blog/release/v26.5.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,111 @@
---
date: '2026-07-29T14:03:39.312Z'
category: release
title: Node.js 26.5.1 (Current)
layout: blog-post
author: Rafael Gonzaga
---

## 2026-07-29, Version 26.5.1 (Current), @RafaelGSS

This is a security release.

### Notable Changes

- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
- deps: update llhttp to 9.4.3 (Paolo Insogna)
- deps: update undici to 8.9.0 (Node.js GitHub Bot)

### Commits

- \[[`af0bf96877`](https://github.com/nodejs/node/commit/af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
- \[[`0354678355`](https://github.com/nodejs/node/commit/0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](https://github.com/nodejs/node/pull/64712)
- \[[`dbeeaeec13`](https://github.com/nodejs/node/commit/dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
- \[[`064d339f56`](https://github.com/nodejs/node/commit/064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
- \[[`23b94c843a`](https://github.com/nodejs/node/commit/23b94c843a)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
- \[[`c7ec3dc0b9`](https://github.com/nodejs/node/commit/c7ec3dc0b9)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904)
- \[[`8f666925b1`](https://github.com/nodejs/node/commit/8f666925b1)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
- \[[`ad99d075b1`](https://github.com/nodejs/node/commit/ad99d075b1)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
- \[[`61222008b7`](https://github.com/nodejs/node/commit/61222008b7)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#908](https://github.com/nodejs-private/node-private/pull/908)
- \[[`3cb607dfc4`](https://github.com/nodejs/node/commit/3cb607dfc4)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#924](https://github.com/nodejs-private/node-private/pull/924)
- \[[`d08fde8a16`](https://github.com/nodejs/node/commit/d08fde8a16)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896)
- \[[`b3fbb6e11f`](https://github.com/nodejs/node/commit/b3fbb6e11f)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)

Windows 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1-arm64.msi \
Windows 64-bit Binary: https://nodejs.org/dist/v26.5.1/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v26.5.1/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v26.5.1/node-v26.5.1.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-aix-ppc64.tar.gz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v26.5.1/node-v26.5.1.tar.gz \
Other release files: https://nodejs.org/dist/v26.5.1/ \
Documentation: https://nodejs.org/docs/v26.5.1/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

0bafe816b17bcaee285e79e325b7a44eea605d12d81b2caa78cddcadf5d1b5f6 node-v26.5.1-aix-ppc64.tar.gz
01875f52263953ad81972d304263f36a71e5e97873fa9fa60989e8973d18d00b node-v26.5.1-arm64.msi
f4387df0b46556516d19abf2f2d6806481ac8368aa7f9d96bafed422a56a1d01 node-v26.5.1-darwin-arm64.tar.gz
f4665a1e764653ec6fe7686309e8907e9ebb9ba68c4b88b9185fdc29f221559b node-v26.5.1-darwin-arm64.tar.xz
077d5c936868dab19d21f77f1e71ce13697e80b3e86a399dcab238902a2ebf93 node-v26.5.1-darwin-x64.tar.gz
4436be8db0e2bd5ca3dee8c48aa8a157c9a8fef99580036ff1da8ef6aba44708 node-v26.5.1-darwin-x64.tar.xz
598a3139679db65461f8af50463d668008eaee5e0d09df4eeaa27f3eeefecc03 node-v26.5.1-headers.tar.gz
f72d24a5a34b40ba738f6d28cdcd50e3f4976558d4f14bebfa64fdbdcfc4951a node-v26.5.1-headers.tar.xz
21194bbf41c18d9ec277545c4d14cce8597d57a9d9f494c323d8121a25de33e8 node-v26.5.1-linux-arm64.tar.gz
0b6b0cc2a1eecbe736f9918de8b5a6c9a48d286b88bec1298a3c1e3376182ea8 node-v26.5.1-linux-arm64.tar.xz
cf518dd2772ea7e5046daf4a4ba9e348fce01e2b9741f32ba21b4bbd87b8dfaf node-v26.5.1-linux-ppc64le.tar.gz
692d0c45896bf232e22b8b64a4a826ed0a70fec75545f208d120c109d0a86752 node-v26.5.1-linux-ppc64le.tar.xz
af5a58fca0c3fc130c6a649bd6c29f4b000145055eb7a364bde189abdf1516f5 node-v26.5.1-linux-s390x.tar.gz
ff4635062f82308dda7c7164337ad9bb383568dac984ff64b35b888e7d7a4ef3 node-v26.5.1-linux-s390x.tar.xz
2b07f09c218d473a26442bff5a90151f53f7b7c0a23bad244eda2c26303a2ba7 node-v26.5.1-linux-x64.tar.gz
cc7b3484ade63bd203a9d304f21ec37a3b622b988d7bdecf1dc4d68fc44a91b7 node-v26.5.1-linux-x64.tar.xz
a6e6cfdb0af6d7d68b50a6f663b8ff321923089309076ea7943a19dbe5eb662a node-v26.5.1-win-arm64.7z
467f425228a2fdcc83a330f5f38b124b5b43b42f5033d7848b4e47c9becc36f9 node-v26.5.1-win-arm64.zip
0c8a1a3604e57400432089cf7e179eac4f25b26445a156aaa98cca5619e50f5c node-v26.5.1-win-x64.7z
c432c996b95cbf7568f13a0fbb37526de84a27e3a5c520c3be15f05a9a168212 node-v26.5.1-win-x64.zip
826a4551bb9d3c00c61c17a2521a1e901ac7304e3090a3c2d07c1e0fe2b4d60d node-v26.5.1-x64.msi
ae175856e12aadc081a539af37a70a71d3233b2e710fa00266137e23e24faca2 node-v26.5.1.pkg
1143281232fc4640188aaa20afb0f9c4f06031f554cd3f1e5ac86e8a0387511a node-v26.5.1.tar.gz
df7770a9a99346f8b73ba6d31ad89bd6f868b51c7387c3627dcb44ca065f4948 node-v26.5.1.tar.xz
c6ca33154ee426f46e02aa9f5676d69b768808b564aa22652fe18bb08c188fe5 win-arm64/node.exe
c01ce0d5e4e956f0e5e73cdba925d15a6d6f86883aa49f8f0b0de87aa93508ce win-arm64/node.lib
83961c8a59f1771a2e0ffcf89487b3fa0a7ca18a69f1061683c27671b36665e5 win-arm64/node_pdb.7z
7b40fa280b35d3aef700852220075f262a25c4cdd9a6f90fb8a3a4b1bed9cf8b win-arm64/node_pdb.zip
b48b0224081224cda1f49374e2fc63d143041ade51754f0cc6608fe8510ba29e win-x64/node.exe
56f06350037085fce04930befd98327afc86ee46f52af6f6f8a68a03630e8380 win-x64/node.lib
cbd18315c40cb831d1a398c0df64a43876999e77eb56b52589b64ee8a5bf93d0 win-x64/node_pdb.7z
fb3b232e033a25d0aae20c0413589569688807471e98a1620ef7f7ec959fbf83 win-x64/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmpqCAYACgkQi+q0389V
XvRsRwv9Gscq3A1VqXWzAWdyE+tWyMGYTSzisHRRudAmDVkUoEK/WHfgmbmFXXDC
IjokChhRdJL4I3DFSq8sntybzGMYb1hqwvPRr9fRCW+6dsVT1eNnb8OQWObqONaq
w8F82T+mSk8D4ZSH7Q9IMGBZBzln3oRBwXuHOUcYMtnMEKgHsP35Li4HARaKWMGE
enlNvp+r9PxHMKXtKl5cFygqh0slhEHJQ/6GzKKNRbSFTpEBkQbtIEaFib7XHguv
6uUj0R0ZhCXrcYzlxhL6KIGHes0jMIRwkM9C3b7Q2c9Jw0PuglhCPdD+VZI1dIU6
7j8f/jyncIZMXE5FNnldwMy9aiA/xcOenTEA/F2yBEM+ErrWf8r7tLQk0JfqmZ1M
qfqHHb2zu2ywcHspOS6Lhn+1wE47rEKAdYYt7iRA4L86TASCie1K8hgrsIJE5z5D
dv02pgX3Oj2hLsCun3PfH6a0MSYXIDCwelz3wn8uWl5tN8pH4F0eLZWJ04sjXvdb
ySj7vo4t
=wksr
-----END PGP SIGNATURE-----
```
Loading