Dev Tools
Node.js Releases Version 26.13.1 (Lithium) LTS to Address Multiple Vulnerabilities
Node.js has published version 26.13.1 (Lithium) as an LTS security release, resolving numerous high, medium, and low severity CVEs affecting HTTP, HTTP/2, TLS, and permissions. The update also upgrades core dependencies like brotli, llhttp, sqlite, and undici.
What Changed
Node.js released version 26.13.1 (Lithium) LTS, addressing multiple security vulnerabilities across various components including HTTP/2, TLS, HTTP, permissions, and zlib. Notable fixes include preventing remotely reachable TLS server crashes, resolving issues with SNI changes during renegotiation or resumption, handling HTTP/2 stream headers and buffer management, redacting proxy credentials in invalid proxy URL errors, and fixing permission checks. Additionally, dependencies were updated, including brotli to 1.2.1, llhttp to 9.4.4, sqlite to 3.54.1, and undici to 8.12.4.
Why It Matters
The release fixes several high-severity security vulnerabilities that could otherwise expose applications to risks such as remote TLS server crashes, improper handling of HTTP/2 streams, and security bypasses in permissions or TLS configuration. Applying this security update ensures that production environments remain protected against these identified vectors.
Practical Impact
Developers and system administrators using Node.js should update to version 26.13.1 to mitigate the patched security vulnerabilities. Upgrading requires standard deployment practices for an LTS release across Windows, macOS, Linux, AIX, and other supported target binary platforms.