Node v24.18.1 nsolid v6.3.4 release - #503
Merged
santigimeno merged 17 commits intoJul 31, 2026
Merged
Conversation
Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs/node#63752 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> CVE-ID: CVE-2026-56846
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#927 CVE-ID: CVE-2026-56847
Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs-private/node-private#921 Refs: https://hackerone.com/reports/3833629 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2026-56848
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#930 Refs: https://hackerone.com/reports/3816840 CVE-ID: CVE-2026-56850
Refs: https://hackerone.com/reports/3815767 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#926 CVE-ID: CVE-2026-58039
SQLTagStore Run/Iterate/Get/All reset the shared cached statement via raw sqlite3_reset(), bypassing ResetStatement() and its reset_generation_ bump, so live iterators were never invalidated. Also mark the iterator done on SQLITE_DONE so it cannot restart the statement. PR-URL: nodejs-private/node-private#896 Refs: https://hackerone.com/reports/3564941 Reviewed-By: Robert Nagy <ronagy@icloud.com> CVE-ID: CVE-2026-58041
Refs: https://hackerone.com/reports/3795657 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#929 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-58042
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#911 Refs: https://hackerone.com/reports/3761342 CVE-ID: CVE-2026-58043
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#931 Refs: https://hackerone.com/reports/3857258 CVE-ID: CVE-2026-58045
PR-URL: nodejs/node#64713 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Signed-off-by: Paolo Insogna <paolo@cowtech.it> PR-URL: nodejs-private/node-private#935 Refs: nodejs-private/llhttp-private#244 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
This is a security release. Notable changes: * (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 7.29.0 (Node.js GitHub Bot) PR-URL: nodejs-private/node-private#937 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
2026-07-29 Node.js v24.18.1 Krypton (LTS) Release Git-EVTag-v0-SHA512: 04092518acce745fae797d9ee29d21abd661e3b4808875a64530244372d900b2b96f8f531c338867e927e299992c979b6782372a6ca036975042ecde3218bdda
Signed-off-by: Santiago Gimeno <santiago.gimeno@gmail.com>
WalkthroughNode.js 24.18.1 updates bundled llhttp and undici versions, strengthens HTTP/cache/cookie validation, adjusts HTTPS reuse and filesystem permission handling, fixes native runtime accounting and bounds checks, adds generated FFI build files, and introduces regression tests. ChangesNode.js 24.18.1 release
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Biome (2.5.5)test/parallel/test-permission-fs-write-trace-events.jsFile contains syntax errors that prevent linting: Line 45: Illegal return statement outside of a function test/parallel/test-permission-fs-write-report.jsFile contains syntax errors that prevent linting: Line 22: Illegal return statement outside of a function Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@lib/internal/process/report.js`:
- Around line 33-40: Use the final report path for all permission checks: in
lib/internal/process/report.js lines 33-40, when file is absent, select
nr.getDirectory() when configured and fall back to process.cwd() only if no
directory is configured; in src/node_report.cc lines 875-887, remove the
permission check against the raw name and retain the check against the
constructed pathname.
In `@src/node_trace_events.cc`:
- Around line 88-93: Authorize each resolved trace rotation path rather than
treating permission for rotation 1 as covering all files: update the enable-time
check in src/node_trace_events.cc (lines 88-93), enforce write permission for
every path opened by NodeTraceWriter in src/tracing/node_trace_writer.cc (lines
81-87), and extend test/parallel/test-permission-fs-write-trace-events.js (lines
58-70) to permit only rotation 1, force a second rotation, and verify rotation 2
is denied.
In `@test/ffi/fixture_library/build/config.gypi`:
- Around line 554-555: Replace the machine-specific absolute values for nodedir
and python in the generated configuration with paths derived from the current
checkout and configured Python environment, matching the existing gyp_main.py
regeneration recipe in Makefile. Ensure regeneration works from any developer
machine without relying on /home/rafaelgss or /usr/bin/python3.12.
In `@test/ffi/fixture_library/build/ffi_test_library.target.mk`:
- Around line 40-47: Replace the developer-specific absolute paths in INCS_Debug
and INCS_Release with portable paths derived from the fixture’s configured
build/output variables, matching the existing regen-only include path
conventions. Ensure the cc/cxx rules rebuilding ffi_test_library.o resolve Node,
OpenSSL, uv, zlib, and V8 headers correctly on any machine.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e9326ed1-2b76-4eef-beab-84b7387b34a4
⛔ Files ignored due to path filters (2)
deps/undici/src/package-lock.jsonis excluded by!**/package-lock.jsontest/node_trace.1.logis excluded by!**/*.log
📒 Files selected for processing (57)
CHANGELOG.mddeps/llhttp/.gitignoredeps/llhttp/CMakeLists.txtdeps/llhttp/include/llhttp.hdeps/llhttp/src/llhttp.cdeps/undici/src/lib/cache/memory-cache-store.jsdeps/undici/src/lib/cache/sqlite-cache-store.jsdeps/undici/src/lib/core/request.jsdeps/undici/src/lib/dispatcher/client-h1.jsdeps/undici/src/lib/handler/cache-handler.jsdeps/undici/src/lib/handler/cache-revalidation-handler.jsdeps/undici/src/lib/handler/retry-handler.jsdeps/undici/src/lib/interceptor/cache.jsdeps/undici/src/lib/llhttp/wasm_build_env.txtdeps/undici/src/lib/util/cache.jsdeps/undici/src/lib/util/date.jsdeps/undici/src/lib/web/cookies/util.jsdeps/undici/src/package.jsondeps/undici/undici.jsdoc/api/http2.mddoc/api/https.mddoc/changelogs/CHANGELOG_V24.mddoc/changelogs/NSOLID_CHANGELOG_V6_NODE_V24.mdlib/https.jslib/internal/process/report.jssrc/cares_wrap.ccsrc/node_http2.ccsrc/node_http2.hsrc/node_http_parser.ccsrc/node_report.ccsrc/node_sqlite.ccsrc/node_trace_events.ccsrc/node_version.hsrc/node_zlib.ccsrc/permission/fs_permission.hsrc/tracing/node_trace_writer.ccsrc/tracing/node_trace_writer.hsrc/undici_version.htest/ffi/fixture_library/build/Makefiletest/ffi/fixture_library/build/binding.Makefiletest/ffi/fixture_library/build/config.gypitest/ffi/fixture_library/build/ffi_test_library.target.mktest/parallel/test-dns-resolveany-ttl-overflow.jstest/parallel/test-http-max-headers-count-overflow.jstest/parallel/test-http-max-headers-count.jstest/parallel/test-http-rawheaders-limit.jstest/parallel/test-http2-max-session-memory-stalled-headers.jstest/parallel/test-http2-rst-stream-reentrancy.jstest/parallel/test-https-agent-checkserveridentity-reuse.jstest/parallel/test-https-agent-getname.jstest/parallel/test-https-agent-pfx-object-array-reuse.jstest/parallel/test-https-max-headers-count.jstest/parallel/test-permission-fs-read.jstest/parallel/test-permission-fs-write-report.jstest/parallel/test-permission-fs-write-trace-events.jstest/parallel/test-sqlite-template-tag.jstest/parallel/test-zlib-invalid-input.js
💤 Files with no reviewable changes (2)
- deps/llhttp/.gitignore
- test/parallel/test-http-rawheaders-limit.js
Comment on lines
+33
to
+40
| let resource = file; | ||
| if (resource !== undefined) { | ||
| const directory = nr.getDirectory(); | ||
| if (directory !== '') | ||
| resource = `${directory}${sep}${resource}`; | ||
| } else { | ||
| resource = process.cwd(); | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use the final report path for every permission check.
A configured report directory is bypassed when file is omitted in JavaScript (process.cwd() is checked), while a relative explicit filename still hits the earlier raw-name check in src/node_report.cc before this final pathname check. A report targeting an allowed directory can therefore be rejected merely because the cwd is denied.
lib/internal/process/report.js#L33-L40: whenfileis absent, usenr.getDirectory()when configured, falling back toprocess.cwd()only when no report directory exists.src/node_report.cc#L875-L887: remove the earlier rawnamepermission check and retain the check against the constructedpathname.
📍 Affects 2 files
lib/internal/process/report.js#L33-L40(this comment)src/node_report.cc#L875-L887
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@lib/internal/process/report.js` around lines 33 - 40, Use the final report
path for all permission checks: in lib/internal/process/report.js lines 33-40,
when file is absent, select nr.getDirectory() when configured and fall back to
process.cwd() only if no directory is configured; in src/node_report.cc lines
875-887, remove the permission check against the raw name and retain the check
against the constructed pathname.
Comment on lines
+88
to
+93
| const std::string filepath = tracing::NodeTraceWriter::GetFilePath( | ||
| per_process::cli_options->trace_event_file_pattern, 1); | ||
| THROW_IF_INSUFFICIENT_PERMISSIONS( | ||
| category_set->env(), | ||
| permission::PermissionScope::kFileSystemWrite, | ||
| filepath); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Authorize every trace rotation path.
The enable-time check authorizes only ${rotation} = 1. Once NodeTraceWriter rotates, it opens ${rotation} = 2 and later files without another permission check. A narrowly granted trace.1.log path can therefore lead to writes outside the allowed resource set.
src/node_trace_events.cc#L88-L93: do not treat authorization of rotation 1 as authorization for all generated files.src/tracing/node_trace_writer.cc#L81-L87: enforce write permission for each resolved rotation path, or associate the writer with an authorization covering the full rotation pattern.test/parallel/test-permission-fs-write-trace-events.js#L58-L70: add coverage that permits only rotation 1, forces a second rotation, and verifies rotation 2 is denied.
📍 Affects 3 files
src/node_trace_events.cc#L88-L93(this comment)src/tracing/node_trace_writer.cc#L81-L87test/parallel/test-permission-fs-write-trace-events.js#L58-L70
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/node_trace_events.cc` around lines 88 - 93, Authorize each resolved trace
rotation path rather than treating permission for rotation 1 as covering all
files: update the enable-time check in src/node_trace_events.cc (lines 88-93),
enforce write permission for every path opened by NodeTraceWriter in
src/tracing/node_trace_writer.cc (lines 81-87), and extend
test/parallel/test-permission-fs-write-trace-events.js (lines 58-70) to permit
only rotation 1, force a second rotation, and verify rotation 2 is denied.
Comment on lines
+554
to
+555
| "nodedir": "/home/rafaelgss/repos/os/node-private/out/Release/addons_headers", | ||
| "python": "/usr/bin/python3.12", |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | 🏗️ Heavy lift
Hardcoded developer-machine paths in the generated config.
nodedir and python are absolute paths specific to the original author's machine. This config is fed into the gyp_main.py regeneration recipe (see Makefile), so a rebuild triggered elsewhere (different checkout path or Python install) would fail.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/ffi/fixture_library/build/config.gypi` around lines 554 - 555, Replace
the machine-specific absolute values for nodedir and python in the generated
configuration with paths derived from the current checkout and configured Python
environment, matching the existing gyp_main.py regeneration recipe in Makefile.
Ensure regeneration works from any developer machine without relying on
/home/rafaelgss or /usr/bin/python3.12.
Comment on lines
+40
to
+47
| INCS_Debug := \ | ||
| -I/home/rafaelgss/repos/os/node-private/out/Release/addons_headers/include/node \ | ||
| -I/home/rafaelgss/repos/os/node-private/out/Release/addons_headers/src \ | ||
| -I/home/rafaelgss/repos/os/node-private/out/Release/addons_headers/deps/openssl/config \ | ||
| -I/home/rafaelgss/repos/os/node-private/out/Release/addons_headers/deps/openssl/openssl/include \ | ||
| -I/home/rafaelgss/repos/os/node-private/out/Release/addons_headers/deps/uv/include \ | ||
| -I/home/rafaelgss/repos/os/node-private/out/Release/addons_headers/deps/zlib \ | ||
| -I/home/rafaelgss/repos/os/node-private/out/Release/addons_headers/deps/v8/include |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | 🏗️ Heavy lift
Hardcoded developer-machine include paths used directly in compilation.
INCS_Debug/INCS_Release point at /home/rafaelgss/repos/os/node-private/out/Release/addons_headers/.... Unlike the regen-only paths elsewhere, these are used unconditionally by the cc/cxx rules whenever ffi_test_library.o is rebuilt (line 100-101), so compiling this fixture on any other machine/CI will fail with missing Node headers.
Also applies to: 82-89
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/ffi/fixture_library/build/ffi_test_library.target.mk` around lines 40 -
47, Replace the developer-specific absolute paths in INCS_Debug and INCS_Release
with portable paths derived from the fixture’s configured build/output
variables, matching the existing regen-only include path conventions. Ensure the
cc/cxx rules rebuilding ffi_test_library.o resolve Node, OpenSSL, uv, zlib, and
V8 headers correctly on any machine.
RafaelGSS
approved these changes
Jul 29, 2026
EHortua
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation