--- title: Node.js — Node.js 24.18.1 (LTS) | daily.dev description: Node.js 24.18.1 (LTS, codename 'Krypton') is a security-only release addressing 11 CVEs across multiple subsystems. High-severity fixes include two HTTP/2... canonical: https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Node.js — Node.js 24.18.1 (LTS) | daily.dev og:description: Node.js 24.18.1 (LTS, codename 'Krypton') is a security-only release addressing 11 CVEs across multiple subsystems. High-severity fixes include two HTTP/2... og:url: https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2 og:image: https://api.daily.dev/og/posts/w2VuXe7f2.png og:image:alt: Node.js — Node.js 24.18.1 (LTS) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Node.js — Node.js 24.18.1 (LTS) **[Node.js](https://daily.dev/sources/nodejs)** · 3 min read · 33 upvotes · 5 comments ## Summary Node.js 24.18.1 (LTS, codename 'Krypton') is a security-only release addressing 11 CVEs across multiple subsystems. High-severity fixes include two HTTP/2 vulnerabilities (memory retention in session accounting and deferred RST stream handling) and a permission model bypass via radix split nodes. Medium-severity fixes cover HTTPS session reuse identity checks, PFX agent key disambiguation, SQLite iterator invalidation on statement reset, DNS large reply handling, and zlib out-of-bounds write protection. Low-severity fixes address permission enforcement for trace events, report output path checks, and HTTP max header count enforcement. Dependencies llhttp (9.4.3) and undici (7.29.0) are also updated. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVEs are fixed in Node.js 24.18.1? Node.js 24.18.1 fixes eleven CVEs spanning multiple subsystems. High-severity issues include CVE-2026-56846 and CVE-2026-56848 in http2 (header memory accounting and RST stream handling) and CVE-2026-58043 in the permission model (radix split node grants). Medium-severity fixes cover https, sqlite, dns, and zlib, while low-severity fixes touch permission checks and http header count limits. _Track Node.js security patches like these on daily.dev before they hit a production deployment._ ### Should I upgrade to Node.js 24.18.1 immediately? Yes, because this is explicitly a security release addressing eleven CVEs, including three rated High severity affecting http2 and the permission model. It also updates llhttp to 9.4.3 and undici to 7.29.0. Anyone running Node.js 24.x LTS in production should apply this patch rather than treat it as an optional maintenance update. _Stay ahead of Node.js LTS security releases with daily.dev when patching production runtimes._ ## Community discussion Top comments from developers on daily.dev. **@fahimahammed** · 1 upvotes > Security-only releases are easy to overlook, but they're some of the most important updates. If you're running Node.js 24.x in production, upgrading to 24.18.1 should be part of your regular maintenance—especially with fixes for HTTP/2, the Permission Model, SQLite, and DNS handling. Staying current with LTS security releases is one of the simplest ways to reduce production risk. **@petecapecod** · 0 upvotes > crap that's a good amount of CVEs 😅 guess it's update time **@pdfopsdev** · 0 upvotes > the http/2 memory retention fix is the one to actually watch your metrics for, deferred RST stream handling leaking session state shows up as slow OOM creep over days, not something you'd catch in a staging smoke test. worth bumping before you forget about it. **@jenueldev** · 0 upvotes > The breadth of this security-only release—HTTP/2, the permission model, TLS session reuse, SQLite, DNS, and zlib—makes a targeted workaround much riskier than a prompt LTS patch. The permission-model fixes especially deserve regression tests around report and trace output plus radix-split paths, because applications relying on that sandbox boundary need to verify both confinement and legitimate access after upgrading. ## Similar posts on daily.dev - [Node.js — Node.js 24.17.0 \(LTS\)](https://daily.dev/posts/node-js-node-js-24-17-0-lts--8fmsqbwyz) · Node.js · 0 upvotes · 0 comments - [Node.js — Node.js 24.14.1 \(LTS\)](https://daily.dev/posts/node-js-node-js-24-14-1-lts--ejvcsmjro) · Node.js · 2 upvotes · 0 comments - [Node.js — Node.js 26.5.1 \(Current\)](https://daily.dev/posts/node-js-node-js-26-5-1-current--hx951gecs) · Node.js · 25 upvotes · 0 comments - [Node.js — Node.js 22.23.2 \(LTS\)](https://daily.dev/posts/node-js-node-js-22-23-2-lts--84txqugm3) · Node.js · 6 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#nodejs](https://daily.dev/tags/nodejs) [View this post on daily.dev](https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Node.js — Node.js 24.18.1 (LTS)","url":"https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2"},"datePublished":"2026-07-29T16:34:22.827Z","dateModified":"2026-09-14T08:18:06.543Z","description":"Node.js 24.18.1 (LTS, codename 'Krypton') is a security-only release addressing 11 CVEs across multiple subsystems. High-severity fixes include two HTTP/2...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1b898d4a2f2b722e0182e65a0068f123?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1b898d4a2f2b722e0182e65a0068f123?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Node.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Node.js","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/nodejs","url":"https://daily.dev/sources/nodejs"},"commentCount":5,"discussionUrl":"https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":33},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":5}],"keywords":"security,javascript,nodejs","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Node.js","item":"https://daily.dev/sources/nodejs"},{"@type":"ListItem","position":3,"name":"Node.js — Node.js 24.18.1 (LTS)"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2","comment":[{"@type":"Comment","text":"Security-only releases are easy to overlook, but they’re some of the most important updates. If you’re running Node.js 24.x in production, upgrading to 24.18.1 should be part of your regular maintenance—especially with fixes for HTTP/2, the Permission Model, SQLite, and DNS handling. Staying current with LTS security releases is one of the simplest ways to reduce production risk.","datePublished":"2026-07-31T14:34:25.374Z","url":"https://daily.dev/posts/w2VuXe7f2#c-rxsh5qVpz","author":{"@type":"Person","name":"Fahim Ahammed Firoz","url":"https://daily.dev/fahimahammed","image":"https://lh3.googleusercontent.com/a/ACg8ocLPDnjeV4QsaVwi1lXMBgMAKbog9I4fgMTTJnHRKE-Uc1NmSJY0=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"crap that’s a good amount of CVEs 😅 guess it’s update time","datePublished":"2026-07-30T12:45:15.679Z","url":"https://daily.dev/posts/w2VuXe7f2#c-XRnTTxYCP","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"}},{"@type":"Comment","text":"the http/2 memory retention fix is the one to actually watch your metrics for, deferred RST stream handling leaking session state shows up as slow OOM creep over days, not something you’d catch in a staging smoke test. worth bumping before you forget about it.","datePublished":"2026-07-29T18:03:03.165Z","url":"https://daily.dev/posts/w2VuXe7f2#c-6G3C6CT6g","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}},{"@type":"Comment","text":"The breadth of this security-only release—HTTP/2, the permission model, TLS session reuse, SQLite, DNS, and zlib—makes a targeted workaround much riskier than a prompt LTS patch. The permission-model fixes especially deserve regression tests around report and trace output plus radix-split paths, because applications relying on that sandbox boundary need to verify both confinement and legitimate access after upgrading.","datePublished":"2026-07-30T04:33:48.847Z","url":"https://daily.dev/posts/w2VuXe7f2#c-kEsu6ZcWH","author":{"@type":"Person","name":"Jenuel Oras Ganawed","url":"https://daily.dev/jenueldev","image":"https://media.daily.dev/image/upload/s--BadmiNyj--/f_auto/v1787625077/avatars/avatar_JJtZr4Sjm?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2#faq","mainEntity":[{"@type":"Question","name":"What CVEs are fixed in Node.js 24.18.1?","acceptedAnswer":{"@type":"Answer","text":"Node.js 24.18.1 fixes eleven CVEs spanning multiple subsystems. High-severity issues include CVE-2026-56846 and CVE-2026-56848 in http2 (header memory accounting and RST stream handling) and CVE-2026-58043 in the permission model (radix split node grants). Medium-severity fixes cover https, sqlite, dns, and zlib, while low-severity fixes touch permission checks and http header count limits. Track Node.js security patches like these on daily.dev before they hit a production deployment."}},{"@type":"Question","name":"Should I upgrade to Node.js 24.18.1 immediately?","acceptedAnswer":{"@type":"Answer","text":"Yes, because this is explicitly a security release addressing eleven CVEs, including three rated High severity affecting http2 and the permission model. It also updates llhttp to 9.4.3 and undici to 7.29.0. Anyone running Node.js 24.x LTS in production should apply this patch rather than treat it as an optional maintenance update. Stay ahead of Node.js LTS security releases with daily.dev when patching production runtimes."}}]} ```