Tuesday, March 24, 2026 Security Releases

Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.

This security release includes the following dependency updates to address public vulnerabilities:

A flaw in Node.js TLS error handling leaves SNICallback invocations unprotected against synchronous exceptions, while the equivalent ALPN and PSK callbacks were already addressed in CVE-2026-21637. This represents an incomplete fix of that prior vulnerability.

When an SNICallback throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process.

Thank you, to mbarbs for reporting this vulnerability and thank you mcollina for fixing it.

A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with…