Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

The Node.js Blog offers developers insights into Node.js runtime, JavaScript ecosystem, and server-side development. Developers can learn about asynchronous programming, event-driven architecture, and building scalable web applications with Node.js, as well as explore updates, releases, and best practices from the Node.js community.

Node.js

Node.js 24.18.1 (LTS, codename 'Krypton') is a security-only release addressing 11 CVEs across multiple subsystems. High-severity fixes include two HTTP/2 vulnerabilities (memory retention in session accounting and deferred RST stream handling) and a permission model bypass via radix split nodes. Medium-severity fixes cover HTTPS session reuse identity checks, PFX agent key disambiguation, SQLite iterator invalidation on statement reset, DNS large reply handling, and zlib out-of-bounds write protection. Low-severity fixes address permission enforcement for trace events, report output path checks, and HTTP max header count enforcement. Dependencies llhttp (9.4.3) and undici (7.29.0) are also updated.

Node.js — Node.js 24.18.1 (LTS)

Security-only releases are easy to overlook, but they’re some of the most important updates. If you’re running Node.js 24.x in production, upgrading to 24.18.1 should be part of your regular maintenance—especially with fixes for HTTP/2, the Permission Model, SQLite, and DNS handling. Staying current with LTS security releases is one of the simplest ways to reduce production risk.

crap that’s a good amount of CVEs 😅 guess it’s update time

the http/2 memory retention fix is the one to actually watch your metrics for, deferred RST stream handling leaking session state shows up as slow OOM creep over days, not something you’d catch in a staging smoke test. worth bumping before you forget about it.

The breadth of this security-only release—HTTP/2, the permission model, TLS session reuse, SQLite, DNS, and zlib—makes a targeted workaround much riskier than a prompt LTS patch. The permission-model fixes especially deserve regression tests around report and trace output plus radix-split paths, because applications relying on that sandbox boundary need to verify both confinement and legitimate access after upgrading.