---
title: "Node.js — Node.js 26.5.1 (Current)"
url: https://daily.dev/posts/node-js-node-js-26-5-1-current--hx951gecs
source_url: https://nodejs.org/en/blog/release/v26.5.1
type: article
source: "Node.js"
published: 2026-07-29T15:23:43.412Z
updated: 2026-07-29T15:24:06.051Z
tags: ["security", "javascript", "nodejs"]
reading_time: 3
upvotes: 25
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Node.js — Node.js 26.5.1 (Current)

**[Node.js](https://daily.dev/sources/nodejs)** · 3 min read · 25 upvotes · 0 comments

## Summary

Node.js 26.5.1 is a dedicated security release addressing 10 CVEs across multiple subsystems. Two high-severity vulnerabilities are patched: an HTTP/2 RST stream issue (CVE-2026-56848) and a permission model flaw allowing radix split node grants (CVE-2026-58043). Five medium-severity fixes cover HTTPS session reuse identity checks, PFX agent key handling, SQLite iterator invalidation, DNS large reply handling, and zlib out-of-bounds writes. Two low-severity permission model issues and one HTTP max header count enforcement fix are also included. Dependencies llhttp (9.4.3) and undici (8.9.0) are updated.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://nodejs.org/en/blog/release/v26.5.1>

## Similar posts on daily.dev

- [Node.js — Node.js 22.23.2 \(LTS\)](https://daily.dev/posts/node-js-node-js-22-23-2-lts--84txqugm3) · Node.js · 6 upvotes · 0 comments
- [Node.js — Node.js 26.3.1 \(Current\)](https://daily.dev/posts/node-js-node-js-26-3-1-current--hp8siu0zv) · Node.js · 3 upvotes · 1 comments
- [Node.js — Node.js 24.18.1 \(LTS\)](https://daily.dev/posts/node-js-node-js-24-18-1-lts--w2vuxe7f2) · Node.js · 33 upvotes · 5 comments

---

Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#nodejs](https://daily.dev/tags/nodejs)

[View this post on daily.dev](https://daily.dev/posts/node-js-node-js-26-5-1-current--hx951gecs)