-
-
Notifications
You must be signed in to change notification settings - Fork 6.5k
feat(blog): create post for v20.20.2 #8772
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| --- | ||
| date: '2026-03-24T20:35:47.550Z' | ||
| category: release | ||
| title: Node.js 20.20.2 (LTS) | ||
| layout: blog-post | ||
| author: Marco Ippolito | ||
| --- | ||
|
|
||
| ## 2026-03-24, Version 20.20.2 'Iron' (LTS), @marco-ippolito | ||
|
|
||
| This is a security release. | ||
|
|
||
| ### Notable Changes | ||
|
|
||
| - (CVE-2026-21717) fix array index hash collision (Joyee Cheung) <https://github.com/nodejs-private/node-private/pull/834> | ||
| - (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) <https://github.com/nodejs-private/node-private/pull/822> | ||
| - (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) <https://github.com/nodejs-private/node-private/pull/821> | ||
| - (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/795> | ||
| - (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/794> | ||
| - (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/832> | ||
| - (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) <https://github.com/nodejs-private/node-private/pull/819> | ||
marco-ippolito marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| ### Commits | ||
|
|
||
| - \[[`cfb51fa9ce`](https://github.com/nodejs/node/commit/cfb51fa9ce)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) [nodejs-private/node-private#831](https://github.com/nodejs-private/node-private/pull/831) | ||
| - \[[`f333d0be5f`](https://github.com/nodejs/node/commit/f333d0be5f)] - **deps**: V8: override `depot_tools` version (Richard Lau) [#62344](https://github.com/nodejs/node/pull/62344) | ||
| - \[[`2acd5d1226`](https://github.com/nodejs/node/commit/2acd5d1226)] - **deps**: update undici to v6.24.1 (Matteo Collina) [#62285](https://github.com/nodejs/node/pull/62285) | ||
| - \[[`af5c144ebc`](https://github.com/nodejs/node/commit/af5c144ebc)] - **(CVE-2026-21717)** **deps,build,test**: fix array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834) | ||
| - \[[`00ad47a28e`](https://github.com/nodejs/node/commit/00ad47a28e)] - **(CVE-2026-21710)** **http**: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) [nodejs-private/node-private#821](https://github.com/nodejs-private/node-private/pull/821) | ||
| - \[[`0123309566`](https://github.com/nodejs/node/commit/0123309566)] - **(CVE-2026-21716)** **permission**: include permission check on lib/fs/promises (RafaelGSS) [nodejs-private/node-private#840](https://github.com/nodejs-private/node-private/pull/840) | ||
| - \[[`00830712bc`](https://github.com/nodejs/node/commit/00830712bc)] - **(CVE-2026-21715)** **permission**: add permission check to realpath.native (RafaelGSS) [nodejs-private/node-private#838](https://github.com/nodejs-private/node-private/pull/838) | ||
| - \[[`a0c73425da`](https://github.com/nodejs/node/commit/a0c73425da)] - **(CVE-2026-21714)** **src**: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) [nodejs-private/node-private#832](https://github.com/nodejs-private/node-private/pull/832) | ||
| - \[[`cc3f294507`](https://github.com/nodejs/node/commit/cc3f294507)] - **(CVE-2026-21637)** **tls**: wrap SNICallback invocation in try/catch (Matteo Collina) [nodejs-private/node-private#839](https://github.com/nodejs-private/node-private/pull/839) | ||
|
|
||
| Windows 32-bit Installer: https://nodejs.org/dist/v20.20.2/node-v20.20.2-x86.msi \ | ||
| Windows 64-bit Installer: https://nodejs.org/dist/v20.20.2/node-v20.20.2-x64.msi \ | ||
| Windows ARM 64-bit Installer: https://nodejs.org/dist/v20.20.2/node-v20.20.2-arm64.msi \ | ||
| Windows 32-bit Binary: https://nodejs.org/dist/v20.20.2/win-x86/node.exe \ | ||
| Windows 64-bit Binary: https://nodejs.org/dist/v20.20.2/win-x64/node.exe \ | ||
| Windows ARM 64-bit Binary: https://nodejs.org/dist/v20.20.2/win-arm64/node.exe \ | ||
| macOS 64-bit Installer: https://nodejs.org/dist/v20.20.2/node-v20.20.2.pkg \ | ||
| macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-darwin-arm64.tar.gz \ | ||
| macOS Intel 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-darwin-x64.tar.gz \ | ||
| Linux 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-x64.tar.xz \ | ||
| Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-ppc64le.tar.xz \ | ||
| Linux s390x 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-s390x.tar.xz \ | ||
| AIX 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-aix-ppc64.tar.gz \ | ||
| ARMv7 32-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-armv7l.tar.xz \ | ||
| ARMv8 64-bit Binary: https://nodejs.org/dist/v20.20.2/node-v20.20.2-linux-arm64.tar.xz \ | ||
| Source Code: https://nodejs.org/dist/v20.20.2/node-v20.20.2.tar.gz \ | ||
| Other release files: https://nodejs.org/dist/v20.20.2/ \ | ||
| Documentation: https://nodejs.org/docs/v20.20.2/api/ | ||
|
|
||
| ### SHASUMS | ||
|
|
||
| ``` | ||
| -----BEGIN PGP SIGNED MESSAGE----- | ||
| Hash: SHA256 | ||
|
|
||
| 3c60f54069a53ad8ffeef2b0f11e1f88333b12decfed755b26ce3fcb5e2d97e4 node-v20.20.2-aix-ppc64.tar.gz | ||
| 1473f48d689627ec35eb4147d0f22ee60c694f16719c20a7c129b925c60f3a2f node-v20.20.2-arm64.msi | ||
| 466e05f3477c20dfb723054dfebffe55bc74660ee77f612166fca121dacb65b6 node-v20.20.2-darwin-arm64.tar.gz | ||
| 6375a1d4421bc04ab284ba89459df788a78c49c89e83c463d0eede47e2efc07b node-v20.20.2-darwin-arm64.tar.xz | ||
| 8be6f5e4bb128c82774f8a0b8d7a1cc1365a7977d9657cece0ca647b3fe04e61 node-v20.20.2-darwin-x64.tar.gz | ||
| 4d4c020eb534497e616de38f3733289ff33c615ddab38c048edec6547b7f76ea node-v20.20.2-darwin-x64.tar.xz | ||
| 6de0e836efa9f32512e61db3dfd08b3d97a015b7e828d1a5efdf281a56a692d9 node-v20.20.2-headers.tar.gz | ||
| 46573741c48c20c6bcfc71450e2fc56b4d1156d72c3d6cc9917fa8b1cbc6e836 node-v20.20.2-headers.tar.xz | ||
| 47ef73d543ecf6eb19435f6c03a0ac4809b3bf0dd6b26c7c571efc2a6572a74d node-v20.20.2-linux-arm64.tar.gz | ||
| 73093db209e4e9e09dd7d15a47aeaab1b74833830df03efa5f942a1122c5fa71 node-v20.20.2-linux-arm64.tar.xz | ||
| 8e15f121e721c9354132053188d4c1a18ea9e345c019ee440fb256e3dda7df15 node-v20.20.2-linux-armv7l.tar.gz | ||
| f704ce75d9a194c30c378049b516000e49612c2f046ac83c7435eb33ec2926f0 node-v20.20.2-linux-armv7l.tar.xz | ||
| 5f2fd0e0cd67aeac0db800b334151cae6ea70ea337487b26f79ac90e3fe126e1 node-v20.20.2-linux-ppc64le.tar.gz | ||
| 4ee91307b3b517f880cd63d3f75fc91f4afc926ad9447661b755d50060ba2816 node-v20.20.2-linux-ppc64le.tar.xz | ||
| ee1ca1193e75a6d31b6007c575deca11b116e84a6bda136ae0e0dbe19399889c node-v20.20.2-linux-s390x.tar.gz | ||
| 00590e7e1295d265fd22706e10467c03ecf170873b76c1835ff74b47b90ce6e0 node-v20.20.2-linux-s390x.tar.xz | ||
| 19e56f0825510207dd904f087fe52faa0a4eb6b2aab5f0ea7a33830d04888b8b node-v20.20.2-linux-x64.tar.gz | ||
| df770b2a6f130ed8627c9782c988fda9669fa23898329a61a871e32f965e007d node-v20.20.2-linux-x64.tar.xz | ||
| 63be4e81a9248c5a5ff5f4a67efffef6a4eaa976f5c7fb0b93027db36342e9a3 node-v20.20.2.pkg | ||
| 8cb85a81f75169eb811f7b2512cf17a646826430debbe016a7461f31e286fdef node-v20.20.2.tar.gz | ||
| 7aeeacdb858299e09a3e0510d4bb8b266923894a9e3ac0058ba89d4ecf4a4cca node-v20.20.2.tar.xz | ||
| f066ba3f80363f8e16a2737a945052ea910733f22c93821519f53667614bafd0 node-v20.20.2-win-arm64.7z | ||
| d5c5b1d56f7f9469830eb1f57efeec0a6a9078c0a9e88cd5b4b4b48f46c22069 node-v20.20.2-win-arm64.zip | ||
| 1bbbfd0312335a95e86642c3beef98bb84def4cca85cd879f3da0baca6797422 node-v20.20.2-win-x64.7z | ||
| dc3700fdd57a63eedb8fd7e3c7baaa32e6a740a1b904167ff4204bc68ed8bf77 node-v20.20.2-win-x64.zip | ||
| 4103cb79dba8c0272e309f8b337c2240369fcba5454bf10c2c4b23932a3c6033 node-v20.20.2-win-x86.7z | ||
| cd34d5da2f36ebd84ed57252756ee512447db4502d9f9e38ca8dccb511b0b352 node-v20.20.2-win-x86.zip | ||
| 9a283dcdb771793d6492235e81f3fc80048db8a37497a0af87b0a9f450d10fa6 node-v20.20.2-x64.msi | ||
| 5bd11635c4d46a14e5f712ffbddf07a8dc01d6e62c5ac1d20cab47b4fd7f5ce0 node-v20.20.2-x86.msi | ||
| a6c4adc2ea22256b5d2df57a981f1538d56d44fc845646a8bdbf66740ac1e948 win-arm64/node.exe | ||
| deacf784c804e5ab9df886b2de4c7a04d77ee1c722e2e4f1567aac62391ec4c4 win-arm64/node.lib | ||
| 46512faa28642586c97e61b1a1431bc0a3b2a85e1d63a22794df3b7ebf8d4cfd win-arm64/node_pdb.7z | ||
| 9a6ba8c56d58883584a27f861c784f203455e9ae4dd882836b16980c95dfa84c win-arm64/node_pdb.zip | ||
| 56c1520ee33b801e8bdb92fb321cf2e98529735b6d12bd4a2a6dec0ac0bab937 win-x64/node.exe | ||
| c4a794e993d9304238523230885e9ec00ca052c73b9558471858eef14916d91f win-x64/node.lib | ||
| e190b1166cce167651d3bd544881420e4642ef2dfc643da0023dee9f91f44046 win-x64/node_pdb.7z | ||
| 656f2062e5cb3057651381d0916ad79b9e2113625572a0745b70bc6844e4196a win-x64/node_pdb.zip | ||
| 33379026333558256e5f467d80c67ba20f6b8e77e8d3ab72ad4dc005f6e11845 win-x86/node.exe | ||
| 962e762b899969e773dc1163d53f1dca10a7769d73217b727a94574d2613355b win-x86/node.lib | ||
| a1f7bfe7e5536488b9270f1c1ea1d5b259753b7ee89dabf8eaabc59bfc26fb60 win-x86/node_pdb.7z | ||
| f9d592b4c57c9749d33570e80f6d63c4aaa2441fb86347c25b81d988c5955889 win-x86/node_pdb.zip | ||
| -----BEGIN PGP SIGNATURE----- | ||
|
|
||
| iQIzBAEBCAAdFiEEzGj1oxBv9EgyLkjtJ/XjjVsKIV8FAmnC9VIACgkQJ/XjjVsK | ||
| IV//Pw//am3VN5wTtH+XMPNIyiFk7yrJPYKFhUPchoYVhKSjmnbdD6zn8F4n5KO6 | ||
| t3P5mORXBai0GDBZA219moPX4CpBlVMDWUm87SPndc2nzS0PiGn/9b2vBOYErvel | ||
| lGPVaRq6MYE4mTKLIFBoApjJ5mBPPWWnzPOgB0nRw08Uv4rjWS88P4R7qohz2+V0 | ||
| L/Szen1f/9F3ev9mGpFXlx4ylNww0ZDu0uJySweZEJE/9s5fq1EkGNQA4zpYpnyU | ||
| oqWHcL7ugQI7/2pQbUYk2W8WXTLi8bBuzjmP6mqetXDzltwchjtB8tmZhBqTKtPP | ||
| QrS0EcS3POe3hrriuqbm/VarpoRiOgexAG4YuzAMIldcSxNYMteSiP95WvPUfa9i | ||
| R7gcZ3KVyOVTtXUTTTqLWQrmzFeDmJNm1Y2n3B+mhKub8PuDwOMbvb77IoV51Azu | ||
| NpFSA+QmosLN3G/ydJI4L4JDme9MaYHPRSmBvEMryvpqNWjVoUn8OkHlmgGGreFu | ||
| QjyfxBzpYXkxkUHHt68wgIC/odUMxuiBWzLQ3pDlKgnR4bLL/uc+GnzXR6JES71X | ||
| NhZAwfLVFTQSBd6oq1ibU1SEObAVe4cIQEezwqT0qy2WFiyikXlgCNRHYtSPtjsf | ||
| A5s7j3cE8/naM28vHrt3kLmLIb5Gik5SL+N4Hig18vwKCyk+KkI= | ||
| =CXge | ||
| -----END PGP SIGNATURE----- | ||
| ``` | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.