---
title: "Node.js — Node.js 24.18.1 (LTS)"
url: https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2
source_url: https://nodejs.org/en/blog/release/v24.18.1
type: article
source: "Node.js"
published: 2026-07-29T16:34:22.827Z
updated: 2026-07-29T16:34:43.719Z
tags: ["security", "javascript", "nodejs"]
reading_time: 3
upvotes: 33
comments: 5
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Node.js — Node.js 24.18.1 (LTS)

**[Node.js](https://daily.dev/sources/nodejs)** · 3 min read · 33 upvotes · 5 comments

## Summary

Node.js 24.18.1 (LTS, codename 'Krypton') is a security-only release addressing 11 CVEs across multiple subsystems. High-severity fixes include two HTTP/2 vulnerabilities (memory retention in session accounting and deferred RST stream handling) and a permission model bypass via radix split nodes. Medium-severity fixes cover HTTPS session reuse identity checks, PFX agent key disambiguation, SQLite iterator invalidation on statement reset, DNS large reply handling, and zlib out-of-bounds write protection. Low-severity fixes address permission enforcement for trace events, report output path checks, and HTTP max header count enforcement. Dependencies llhttp (9.4.3) and undici (7.29.0) are also updated.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://nodejs.org/en/blog/release/v24.18.1>

## Community discussion

Top comments from developers on daily.dev.

**@fahimahammed** · 1 upvotes

> Security-only releases are easy to overlook, but they're some of the most important updates. If you're running Node.js 24.x in production, upgrading to 24.18.1 should be part of your regular maintenance—especially with fixes for HTTP/2, the Permission Model, SQLite, and DNS handling. Staying current with LTS security releases is one of the simplest ways to reduce production risk.

**@petecapecod** · 0 upvotes

> crap that's a good amount of CVEs 😅 guess it's update time

**@pdfopsdev** · 0 upvotes

> the http/2 memory retention fix is the one to actually watch your metrics for, deferred RST stream handling leaking session state shows up as slow OOM creep over days, not something you'd catch in a staging smoke test. worth bumping before you forget about it.

**@jenueldev** · 0 upvotes

> The breadth of this security-only release—HTTP/2, the permission model, TLS session reuse, SQLite, DNS, and zlib—makes a targeted workaround much riskier than a prompt LTS patch. The permission-model fixes especially deserve regression tests around report and trace output plus radix-split paths, because applications relying on that sandbox boundary need to verify both confinement and legitimate access after upgrading.

## Similar posts on daily.dev

- [Node.js — Node.js 24.14.1 \(LTS\)](https://daily.dev/posts/node-js-node-js-24-14-1-lts--ejvcsmjro) · Node.js · 2 upvotes · 0 comments
- [Node.js — Node.js 24.17.0 \(LTS\)](https://daily.dev/posts/node-js-node-js-24-17-0-lts--8fmsqbwyz) · Node.js · 0 upvotes · 0 comments
- [Node.js — Node.js 26.5.1 \(Current\)](https://daily.dev/posts/node-js-node-js-26-5-1-current--hx951gecs) · Node.js · 25 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#nodejs](https://daily.dev/tags/nodejs)

[View this post on daily.dev](https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2)