Node.js Blog

Node.js 24.18.1 (LTS)

7.5内容质量

TL;DR · AI 摘要

Node.js 24.18.1 LTS 版本发布，包含多个安全补丁和依赖项更新，适用于需要及时修复漏洞的开发者。

核心要点

  • 修复了11个安全漏洞，包括CVE-2026-56846等高危问题
  • 更新了llhttp到9.4.3版本和undici到7.29.0版本
  • 建议生产环境及时升级以防止潜在攻击

结构提纲

按章节快速跳转。

  1. §版本说明

    宣布Node.js 24.18.1 LTS版本发布，包含安全修复和依赖更新。

  2. ·安全更新

    修复了11个安全漏洞，包含高危等级的CVE-2026-56846等补丁。

  3. ·依赖更新

    更新了llhttp和undici等核心依赖库到最新版本。

  4. ›下载链接

    提供Windows 64位和ARM64位安装包及二进制文件下载地址。

思维导图

用一张图看清主题之间的关系。

查看大纲文本（无障碍 / 无 JS 友好）
  • Node.js 24.18.1 LTS
    • 安全补丁
      • CVE-2026-56846等11个漏洞修复
    • 依赖更新
      • llhttp 9.4.3
      • undici 7.29.0
    • 下载资源
      • Windows安装包
      • 二进制文件

金句 / Highlights

值得收藏与分享的关键句。

#Node.js#LTS#安全更新#依赖管理
打开原文

Node.js — Node.js 24.18.1 (LTS)

Node.js 24.18.1 (LTS)

JJA

Juan José

Node.js 24.18.1 (LTS)

2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

This is a security release.

Notable Changes

  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

  • [ 6cb0475751 ] - deps : update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
  • [ bcfe21d3dc ] - deps : update undici to 7.29.0 (Node.js GitHub Bot) #64713
  • [ 9d0d36cffd ] - (CVE-2026-58042) dns : handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
  • [ 8a008fb523 ] - (CVE-2026-58044) http : reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
  • [ a77c7f7354 ] - (CVE-2026-56848) http2 : defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
  • [ 34ed88a069 ] - (CVE-2026-56846) http2 : retain header memory in session accounting (Matteo Collina) #63752
  • [ 95ba2cfde7 ] - (CVE-2026-58040) https : bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
  • [ fcbdbe47ea ] - (CVE-2026-56850) https : distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
  • [ ea26c12b56 ] - (CVE-2026-58043) permission : avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
  • [ 9a6b7e343a ] - (CVE-2026-58039) permission : check final report output path (RafaelGSS) nodejs-private/node-private#926
  • [ 6c0c990880 ] - (CVE-2026-56847) permission : enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
  • [ af9ff0490c ] - (CVE-2026-58041) sqlite : invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
  • [ 05f541b5c0 ] - (CVE-2026-58045) zlib : throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

Windows 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-x64.msi Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-arm64.msi Windows 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-x64/node.exe Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-arm64/node.exe macOS 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1.pkg macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-arm64.tar.gz macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-x64.tar.gz Linux 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-x64.tar.xz Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-ppc64le.tar.xz Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-s390x.tar.xz AIX 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-aix-ppc64.tar.gz ARMv8 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-arm64.tar.xz Source Code: https://nodejs.org/dist/v24.18.1/node-v24.18.1.tar.gz Other release files: https://nodejs.org/dist/v24.18.1/ Documentation: https://nodejs.org/docs/v24.18.1/api/

SHASUMS

code
-----BEGIN
PGP
SIGNED
MESSAGE-----
Hash:
SHA256
3c76240c07b9f03574a5cf8ed8ba19e8db89271943817b1a4b94de43c97a9e66
node-v24.18.1-aix-ppc64.tar.gz
c3897213475a089b526c8ffb5a84b0151d03eb2206d3e38aac44b2c053719b81
node-v24.18.1-arm64.msi
eb02f7fab96d3d67de40c5ec8566096fcb4c2026728787683ae5a97eb612b941
node-v24.18.1-darwin-arm64.tar.gz
1d60b703fe5d7e7072489be8187f430f1a095a658c31e5e1e281331a5873fac3
node-v24.18.1-darwin-arm64.tar.xz
6fb20fceacbb157c2f95825b80df4a454a0f6d81cdcd7bb81eeae9147e0e76ec
node-v24.18.1-darwin-x64.tar.gz
f892c7895720f40d3750bde24f3554242d36f23602b5167b5b73ec4d13938aef
node-v24.18.1-darwin-x64.tar.xz
bee7344a7fc6e3252c4822ca916a50cd6ddda9bb39374d6140a8046d9238fded
node-v24.18.1-headers.tar.gz
38d44792ec2bee82aca52dbe166979a146f5e75e09ee35e0c0b017b8e2db7c48
node-v24.18.1-headers.tar.xz
df224555a083b918e46260cc969838501b9f9a87140c1195e5b9597b56d5dae2
node-v24.18.1-linux-arm64.tar.gz
7201e3a09dc825bac57867c81913e2b8f0ef87d04cb9082af4cda82f6ff3d88c
node-v24.18.1-linux-arm64.tar.xz
4a8c6209ba3a5aea84c40201d896624ed706b9799a6dc54cbd965433a369a3d0
node-v24.18.1-linux-ppc64le.tar.gz
c47812c13862be7f6e71194c434c4d78a99096e72efb9c31a2627437e056d669
node-v24.18.1-linux-ppc64le.tar.xz
62ad850efefa9ab42a3e901d8e0de86d71bf9c8a0c389dabed248f1ec9590c5a
node-v24.18.1-linux-s390x.tar.gz
acf57bd726f35afc2ba8475194e5a8bd532c00e1a3b2436295b2fbdde199d0e9
node-v24.18.1-linux-s390x.tar.xz
9f5eb6ac21845a66c493c91a253b1da32fd684e89e9b7202d4936982336be4ca
node-v24.18.1-linux-x64.tar.gz
d6c664df3f3f61458e8c277585571328522d705166723a7c7823a9253a4d15a0
node-v24.18.1-linux-x64.tar.xz
c2e424f198dab39b5c68e8b06e0cdba9761dca9b5b432941fce6399d6460dabb
node-v24.18.1.pkg
b62cd76de0a0a28dd9ff88580c92344bdeb008f21c1d7479c5d8659cd96ef4e2
node-v24.18.1.tar.gz
86d40d594bbdfcf69009a62fdf43cb19ae72b6cb5822d2bdd8349c5a1b2fa628
node-v24.18.1.tar.xz
8aed98bca9260716236be292807dcb2638827750ba2fbcfc684601a9a6b8ab48
node-v24.18.1-win-arm64.7z
ffbc7d3e1baf6804f7431ff94f19b9a885a650568c93ea4ccb1bb0038f6af825
node-v24.18.1-win-arm64.zip
365ecf84eeefb87a5a4c94f1e54919696cf5581285db4e589e84d46c0e167406
node-v24.18.1-win-x64.7z
ec56b84a7551893ab2324ebdfdc4ab974a63b4781162600b68a1293cc3e53765
node-v24.18.1-win-x64.zip
af4a0651a26f04ac240f00fec872f305547ca2aa56301c41dfd63a29eb2ab836
node-v24.18.1-x64.msi
845fc4ce00780241667f92e8f7a3a679321a655dddb3b610f2d85693b17ddf28
win-arm64/node.exe
7da03c5111815b69bbe63ffd2e51b28cd69eec9f545b7ccb8756efffdbb88dc2
win-arm64/node.lib
86a5fa89be9c19be42864edfbc2721931fa3c5b318c0f5cd7c1b5c0f49c1f259
win-arm64/node_pdb.7z
0e085f6058961484fb7e93a35ccd0b1ff02efed7bfe1387203097614dc9864a2
win-arm64/node_pdb.zip
ac51903c4c111815d52280b1fdcc8da067cbb37e2fe1a765097b85c3292c8582
win-x64/node.exe
589684168a73547ca47cd22d76a4e465ef561abe89fb1b2b23fe35bbe857d505
win-x64/node.lib
50155c3c9afe1c3ce9a57a8763ed421acc72845c2d30f79d93afe73cb65473ef
win-x64/node_pdb.7z
a9970c87747af4ef15524240dc28ebcf64080c7a68e39d2a406b743e438b6a20
win-x64/node_pdb.zip
-----BEGIN
PGP
SIGNATURE-----
iHUEARYIAB0WIQTdeS9Zc8beUsQyy9rHer+gDdvytwUCamomTgAKCRDHer+gDdvy
twyzAQDrLBWmNsaCn+z0wLyVZgHGA4R5wjJcIil2aKvsiiwDgwEAosTcDL1Me9tq
sDclFViJ4DaRM2efOzyjeLKf/qKH+go=
=4N8e
-----END
PGP
SIGNATURE-----

Next

Node.js 26.5.1 (Current)