diff --git a/apps/site/pages/en/blog/release/v20.20.2.md b/apps/site/pages/en/blog/release/v20.20.2.md new file mode 100644 index 0000000000000..210b09f55832f --- /dev/null +++ b/apps/site/pages/en/blog/release/v20.20.2.md @@ -0,0 +1,117 @@ +--- +date: '2026-03-24T20:35:47.550Z' +category: release +title: Node.js 20.20.2 (LTS) +layout: blog-post +author: Marco Ippolito +--- + +## 2026-03-24, Version 20.20.2 'Iron' (LTS), @marco-ippolito + +This is a security release. + +### Notable Changes + +- (CVE-2026-21717) fix array index hash collision (Joyee Cheung) +- (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) +- (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) +- (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) +- (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) +- (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) +- (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) + +### Commits + +- \[[`cfb51fa9ce`](https://github.com/nodejs/node/commit/cfb51fa9ce)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) [nodejs-private/node-private#831](https://github.com/nodejs-private/node-private/pull/831) +- \[[`f333d0be5f`](https://github.com/nodejs/node/commit/f333d0be5f)] - **deps**: V8: override `depot_tools` version (Richard Lau) [#62344](https://github.com/nodejs/node/pull/62344) +- \[[`2acd5d1226`](https://github.com/nodejs/node/commit/2acd5d1226)] - **deps**: update undici to v6.24.1 (Matteo Collina) [#62285](https://github.com/nodejs/node/pull/62285) +- \[[`af5c144ebc`](https://github.com/nodejs/node/commit/af5c144ebc)] - **(CVE-2026-21717)** **deps,build,test**: fix array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834) +- \[[`00ad47a28e`](https://github.com/nodejs/node/commit/00ad47a28e)] - **(CVE-2026-21710)** **http**: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) [nodejs-private/node-private#821](https://github.com/nodejs-private/node-private/pull/821) +- \[[`0123309566`](https://github.com/nodejs/node/commit/0123309566)] - **(CVE-2026-21716)** **permission**: include permission check on lib/fs/promises (RafaelGSS) [nodejs-private/node-private#840](https://github.com/nodejs-private/node-private/pull/840) +- \[[`00830712bc`](https://github.com/nodejs/node/commit/00830712bc)] - **(CVE-2026-21715)** **permission**: add permission check to realpath.native (RafaelGSS) [nodejs-private/node-private#838](https://github.com/nodejs-private/node-private/pull/838) +- \[[`a0c73425da`](https://github.com/nodejs/node/commit/a0c73425da)] - **(CVE-2026-21714)** **src**: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) [nodejs-private/node-private#832](https://github.com/nodejs-private/node-private/pull/832) +- \[[`cc3f294507`](https://github.com/nodejs/node/commit/cc3f294507)] - **(CVE-2026-21637)** **tls**: wrap SNICallback invocation in try/catch (Matteo Collina) [nodejs-private/node-private#839](https://github.com/nodejs-private/node-private/pull/839) + +Windows 32-bit Installer: https://nodejs.org/dist/v20.20.2/node-v20.20.2-x86.msi \ +Windows 64-bit Installer: https://nodejs.org/dist/v20.20.2/node-v20.20.2-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v20.20.2/node-v20.20.2-arm64.msi \ +Windows 32-bit Binary: https://nodejs.org/dist/v20.20.2/win-x86/node.exe \ +Windows 64-bit Binary: https://nodejs.org/dist/v20.20.2/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v20.20.2/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v20.20.2/node-v20.20.2.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-aix-ppc64.tar.gz \ +ARMv7 32-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-armv7l.tar.xz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v20.20.2/node-v20.20.2.tar.gz \ +Other release files: https://nodejs.org/dist/v20.20.2/ \ +Documentation: https://nodejs.org/docs/v20.20.2/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +3c60f54069a53ad8ffeef2b0f11e1f88333b12decfed755b26ce3fcb5e2d97e4 node-v20.20.2-aix-ppc64.tar.gz +1473f48d689627ec35eb4147d0f22ee60c694f16719c20a7c129b925c60f3a2f node-v20.20.2-arm64.msi +466e05f3477c20dfb723054dfebffe55bc74660ee77f612166fca121dacb65b6 node-v20.20.2-darwin-arm64.tar.gz +6375a1d4421bc04ab284ba89459df788a78c49c89e83c463d0eede47e2efc07b node-v20.20.2-darwin-arm64.tar.xz +8be6f5e4bb128c82774f8a0b8d7a1cc1365a7977d9657cece0ca647b3fe04e61 node-v20.20.2-darwin-x64.tar.gz +4d4c020eb534497e616de38f3733289ff33c615ddab38c048edec6547b7f76ea node-v20.20.2-darwin-x64.tar.xz +6de0e836efa9f32512e61db3dfd08b3d97a015b7e828d1a5efdf281a56a692d9 node-v20.20.2-headers.tar.gz +46573741c48c20c6bcfc71450e2fc56b4d1156d72c3d6cc9917fa8b1cbc6e836 node-v20.20.2-headers.tar.xz +47ef73d543ecf6eb19435f6c03a0ac4809b3bf0dd6b26c7c571efc2a6572a74d node-v20.20.2-linux-arm64.tar.gz +73093db209e4e9e09dd7d15a47aeaab1b74833830df03efa5f942a1122c5fa71 node-v20.20.2-linux-arm64.tar.xz +8e15f121e721c9354132053188d4c1a18ea9e345c019ee440fb256e3dda7df15 node-v20.20.2-linux-armv7l.tar.gz +f704ce75d9a194c30c378049b516000e49612c2f046ac83c7435eb33ec2926f0 node-v20.20.2-linux-armv7l.tar.xz +5f2fd0e0cd67aeac0db800b334151cae6ea70ea337487b26f79ac90e3fe126e1 node-v20.20.2-linux-ppc64le.tar.gz +4ee91307b3b517f880cd63d3f75fc91f4afc926ad9447661b755d50060ba2816 node-v20.20.2-linux-ppc64le.tar.xz +ee1ca1193e75a6d31b6007c575deca11b116e84a6bda136ae0e0dbe19399889c node-v20.20.2-linux-s390x.tar.gz +00590e7e1295d265fd22706e10467c03ecf170873b76c1835ff74b47b90ce6e0 node-v20.20.2-linux-s390x.tar.xz +19e56f0825510207dd904f087fe52faa0a4eb6b2aab5f0ea7a33830d04888b8b node-v20.20.2-linux-x64.tar.gz +df770b2a6f130ed8627c9782c988fda9669fa23898329a61a871e32f965e007d node-v20.20.2-linux-x64.tar.xz +63be4e81a9248c5a5ff5f4a67efffef6a4eaa976f5c7fb0b93027db36342e9a3 node-v20.20.2.pkg +8cb85a81f75169eb811f7b2512cf17a646826430debbe016a7461f31e286fdef node-v20.20.2.tar.gz +7aeeacdb858299e09a3e0510d4bb8b266923894a9e3ac0058ba89d4ecf4a4cca node-v20.20.2.tar.xz +f066ba3f80363f8e16a2737a945052ea910733f22c93821519f53667614bafd0 node-v20.20.2-win-arm64.7z +d5c5b1d56f7f9469830eb1f57efeec0a6a9078c0a9e88cd5b4b4b48f46c22069 node-v20.20.2-win-arm64.zip +1bbbfd0312335a95e86642c3beef98bb84def4cca85cd879f3da0baca6797422 node-v20.20.2-win-x64.7z +dc3700fdd57a63eedb8fd7e3c7baaa32e6a740a1b904167ff4204bc68ed8bf77 node-v20.20.2-win-x64.zip +4103cb79dba8c0272e309f8b337c2240369fcba5454bf10c2c4b23932a3c6033 node-v20.20.2-win-x86.7z +cd34d5da2f36ebd84ed57252756ee512447db4502d9f9e38ca8dccb511b0b352 node-v20.20.2-win-x86.zip +9a283dcdb771793d6492235e81f3fc80048db8a37497a0af87b0a9f450d10fa6 node-v20.20.2-x64.msi +5bd11635c4d46a14e5f712ffbddf07a8dc01d6e62c5ac1d20cab47b4fd7f5ce0 node-v20.20.2-x86.msi +a6c4adc2ea22256b5d2df57a981f1538d56d44fc845646a8bdbf66740ac1e948 win-arm64/node.exe +deacf784c804e5ab9df886b2de4c7a04d77ee1c722e2e4f1567aac62391ec4c4 win-arm64/node.lib +46512faa28642586c97e61b1a1431bc0a3b2a85e1d63a22794df3b7ebf8d4cfd win-arm64/node_pdb.7z +9a6ba8c56d58883584a27f861c784f203455e9ae4dd882836b16980c95dfa84c win-arm64/node_pdb.zip +56c1520ee33b801e8bdb92fb321cf2e98529735b6d12bd4a2a6dec0ac0bab937 win-x64/node.exe +c4a794e993d9304238523230885e9ec00ca052c73b9558471858eef14916d91f win-x64/node.lib +e190b1166cce167651d3bd544881420e4642ef2dfc643da0023dee9f91f44046 win-x64/node_pdb.7z +656f2062e5cb3057651381d0916ad79b9e2113625572a0745b70bc6844e4196a win-x64/node_pdb.zip +33379026333558256e5f467d80c67ba20f6b8e77e8d3ab72ad4dc005f6e11845 win-x86/node.exe +962e762b899969e773dc1163d53f1dca10a7769d73217b727a94574d2613355b win-x86/node.lib +a1f7bfe7e5536488b9270f1c1ea1d5b259753b7ee89dabf8eaabc59bfc26fb60 win-x86/node_pdb.7z +f9d592b4c57c9749d33570e80f6d63c4aaa2441fb86347c25b81d988c5955889 win-x86/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCAAdFiEEzGj1oxBv9EgyLkjtJ/XjjVsKIV8FAmnC9VIACgkQJ/XjjVsK +IV//Pw//am3VN5wTtH+XMPNIyiFk7yrJPYKFhUPchoYVhKSjmnbdD6zn8F4n5KO6 +t3P5mORXBai0GDBZA219moPX4CpBlVMDWUm87SPndc2nzS0PiGn/9b2vBOYErvel +lGPVaRq6MYE4mTKLIFBoApjJ5mBPPWWnzPOgB0nRw08Uv4rjWS88P4R7qohz2+V0 +L/Szen1f/9F3ev9mGpFXlx4ylNww0ZDu0uJySweZEJE/9s5fq1EkGNQA4zpYpnyU +oqWHcL7ugQI7/2pQbUYk2W8WXTLi8bBuzjmP6mqetXDzltwchjtB8tmZhBqTKtPP +QrS0EcS3POe3hrriuqbm/VarpoRiOgexAG4YuzAMIldcSxNYMteSiP95WvPUfa9i +R7gcZ3KVyOVTtXUTTTqLWQrmzFeDmJNm1Y2n3B+mhKub8PuDwOMbvb77IoV51Azu +NpFSA+QmosLN3G/ydJI4L4JDme9MaYHPRSmBvEMryvpqNWjVoUn8OkHlmgGGreFu +QjyfxBzpYXkxkUHHt68wgIC/odUMxuiBWzLQ3pDlKgnR4bLL/uc+GnzXR6JES71X +NhZAwfLVFTQSBd6oq1ibU1SEObAVe4cIQEezwqT0qy2WFiyikXlgCNRHYtSPtjsf +A5s7j3cE8/naM28vHrt3kLmLIb5Gik5SL+N4Hig18vwKCyk+KkI= +=CXge +-----END PGP SIGNATURE----- +```