node 26.12.1 released

The release of node 26.12.1 arrives as a security update, addressing several vulnerabilities within the runtime.

Key security fixes include measures to prevent issues like those listed under CVE-2026-106069 and CVE-2026-106072, where TLS now rejects non-canonical IP addresses, a change implemented by Matteo Collina.

Furthermore, the update tackles DNS resolution input validation for null bytes, a high-severity issue handled by James M Snell (CVE-2026-105482). Another high-impact fix involves TLS, where James M Snell resolved an IP normalization regression (CVE-2026-105483).

In node 24.22.1, we see a similar pattern of security hardening. This version addresses CVE-2026-105481, ensuring agent data guard functions correctly without I/O, credited to James M Snell.

The maintenance of cryptographic integrity is evident across these releases. For instance, node 26.12.1 includes fixes for CVE-2026-111497, exposing `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel), alongside dependency updates like cherry-picking 0ed4268a4401abcb44720963 in brotli.

Node 22.23.4 also focuses heavily on security, implementing fixes for CVE-2026-105481 and CVE-2026-105482, mirroring the protective measures seen in the other releases.

Across all versions, dependency management is active; updates include c-ares to 1.34.9 (Node.js GitHub Bot) and V8 backports, as seen in the commits for node 24.22.1.

These releases also bring infrastructural improvements, such as crypto updates to NSS 3.131.1 (Antoine du Hamel) and hardening X.509 conversion and formatting (Filip Skokan) in node 26.12.1.