Node.js 24.22.1 LTS fixes seven security flaws, updates OpenSSL and root certs

The Node.js project released version 24.22.1, an LTS security update addressing seven CVEs. Three high-severity issues affect TLS IP address handling and DNS resolution input validation. The release also updates OpenSSL to 3.5.9, refreshes root certificates to NSS 3.131.1, and bumps c-ares, timezone data, and the undici HTTP client. Users on the Node.js 24.x LTS line should upgrade promptly.

Security fixes in Node.js 24.22.1

• CVE-2026-106069, CVE-2026-106072 (High): TLS now rejects non-canonical IP addresses — prevents certificate validation bypass via malformed IP representations
• CVE-2026-105482 (High): DNS resolve functions validate inputs for embedded null bytes, preventing injection-style attacks
• CVE-2026-105483 (High): Fixes an IP normalization regression in TLS that could affect certificate matching
• CVE-2026-111497 (High): Brotli dependency patched with upstream commit 0ed4268a4401abcb44720963
• CVE-2026-105481 (Medium): HTTP agent data guard now functions correctly without requiring I/O operations
• CVE-2026-106074 (Medium): Crypto random caches are reset across V8 snapshots to prevent state leakage
• CVE-2026-106073 (Low): Permission model now checked in realpathSync for consistency with other path operations
• Dependencies: OpenSSL 3.5.9, c-ares 1.34.9, timezone 2026e, undici 7.30.1, NSS 3.131.1 root certificates

Why it matters

As an LTS security release with multiple high-severity CVEs in core networking components (TLS, DNS, HTTP), this update is critical for production Node.js deployments. The OpenSSL and root certificate updates also ensure continued trust chain validity as older certificates expire.