---
date: '2026-07-29T16:19:07.684Z'
category: release
title: Node.js 24.18.1 (LTS)
layout: blog-post
author: Juan José
---

## 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

This is a security release.

### Notable Changes

- (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
- deps: update llhttp to 9.4.3 (Paolo Insogna)
- deps: update undici to 7.29.0 (Node.js GitHub Bot)

### Commits

- \[[`6cb0475751`](https://github.com/nodejs/node/commit/6cb0475751)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
- \[[`bcfe21d3dc`](https://github.com/nodejs/node/commit/bcfe21d3dc)] - **deps**: update undici to 7.29.0 (Node.js GitHub Bot) [#64713](https://github.com/nodejs/node/pull/64713)
- \[[`9d0d36cffd`](https://github.com/nodejs/node/commit/9d0d36cffd)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
- \[[`8a008fb523`](https://github.com/nodejs/node/commit/8a008fb523)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
- \[[`a77c7f7354`](https://github.com/nodejs/node/commit/a77c7f7354)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
- \[[`34ed88a069`](https://github.com/nodejs/node/commit/34ed88a069)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#63752](https://github.com/nodejs/node/pull/63752)
- \[[`95ba2cfde7`](https://github.com/nodejs/node/commit/95ba2cfde7)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904)
- \[[`fcbdbe47ea`](https://github.com/nodejs/node/commit/fcbdbe47ea)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
- \[[`ea26c12b56`](https://github.com/nodejs/node/commit/ea26c12b56)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
- \[[`9a6b7e343a`](https://github.com/nodejs/node/commit/9a6b7e343a)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926)
- \[[`6c0c990880`](https://github.com/nodejs/node/commit/6c0c990880)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927)
- \[[`af9ff0490c`](https://github.com/nodejs/node/commit/af9ff0490c)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896)
- \[[`05f541b5c0`](https://github.com/nodejs/node/commit/05f541b5c0)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)

Windows 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1-arm64.msi \
Windows 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v24.18.1/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v24.18.1/node-v24.18.1.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-aix-ppc64.tar.gz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v24.18.1/node-v24.18.1-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v24.18.1/node-v24.18.1.tar.gz \
Other release files: https://nodejs.org/dist/v24.18.1/ \
Documentation: https://nodejs.org/docs/v24.18.1/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

3c76240c07b9f03574a5cf8ed8ba19e8db89271943817b1a4b94de43c97a9e66  node-v24.18.1-aix-ppc64.tar.gz
c3897213475a089b526c8ffb5a84b0151d03eb2206d3e38aac44b2c053719b81  node-v24.18.1-arm64.msi
eb02f7fab96d3d67de40c5ec8566096fcb4c2026728787683ae5a97eb612b941  node-v24.18.1-darwin-arm64.tar.gz
1d60b703fe5d7e7072489be8187f430f1a095a658c31e5e1e281331a5873fac3  node-v24.18.1-darwin-arm64.tar.xz
6fb20fceacbb157c2f95825b80df4a454a0f6d81cdcd7bb81eeae9147e0e76ec  node-v24.18.1-darwin-x64.tar.gz
f892c7895720f40d3750bde24f3554242d36f23602b5167b5b73ec4d13938aef  node-v24.18.1-darwin-x64.tar.xz
bee7344a7fc6e3252c4822ca916a50cd6ddda9bb39374d6140a8046d9238fded  node-v24.18.1-headers.tar.gz
38d44792ec2bee82aca52dbe166979a146f5e75e09ee35e0c0b017b8e2db7c48  node-v24.18.1-headers.tar.xz
df224555a083b918e46260cc969838501b9f9a87140c1195e5b9597b56d5dae2  node-v24.18.1-linux-arm64.tar.gz
7201e3a09dc825bac57867c81913e2b8f0ef87d04cb9082af4cda82f6ff3d88c  node-v24.18.1-linux-arm64.tar.xz
4a8c6209ba3a5aea84c40201d896624ed706b9799a6dc54cbd965433a369a3d0  node-v24.18.1-linux-ppc64le.tar.gz
c47812c13862be7f6e71194c434c4d78a99096e72efb9c31a2627437e056d669  node-v24.18.1-linux-ppc64le.tar.xz
62ad850efefa9ab42a3e901d8e0de86d71bf9c8a0c389dabed248f1ec9590c5a  node-v24.18.1-linux-s390x.tar.gz
acf57bd726f35afc2ba8475194e5a8bd532c00e1a3b2436295b2fbdde199d0e9  node-v24.18.1-linux-s390x.tar.xz
9f5eb6ac21845a66c493c91a253b1da32fd684e89e9b7202d4936982336be4ca  node-v24.18.1-linux-x64.tar.gz
d6c664df3f3f61458e8c277585571328522d705166723a7c7823a9253a4d15a0  node-v24.18.1-linux-x64.tar.xz
c2e424f198dab39b5c68e8b06e0cdba9761dca9b5b432941fce6399d6460dabb  node-v24.18.1.pkg
b62cd76de0a0a28dd9ff88580c92344bdeb008f21c1d7479c5d8659cd96ef4e2  node-v24.18.1.tar.gz
86d40d594bbdfcf69009a62fdf43cb19ae72b6cb5822d2bdd8349c5a1b2fa628  node-v24.18.1.tar.xz
8aed98bca9260716236be292807dcb2638827750ba2fbcfc684601a9a6b8ab48  node-v24.18.1-win-arm64.7z
ffbc7d3e1baf6804f7431ff94f19b9a885a650568c93ea4ccb1bb0038f6af825  node-v24.18.1-win-arm64.zip
365ecf84eeefb87a5a4c94f1e54919696cf5581285db4e589e84d46c0e167406  node-v24.18.1-win-x64.7z
ec56b84a7551893ab2324ebdfdc4ab974a63b4781162600b68a1293cc3e53765  node-v24.18.1-win-x64.zip
af4a0651a26f04ac240f00fec872f305547ca2aa56301c41dfd63a29eb2ab836  node-v24.18.1-x64.msi
845fc4ce00780241667f92e8f7a3a679321a655dddb3b610f2d85693b17ddf28  win-arm64/node.exe
7da03c5111815b69bbe63ffd2e51b28cd69eec9f545b7ccb8756efffdbb88dc2  win-arm64/node.lib
86a5fa89be9c19be42864edfbc2721931fa3c5b318c0f5cd7c1b5c0f49c1f259  win-arm64/node_pdb.7z
0e085f6058961484fb7e93a35ccd0b1ff02efed7bfe1387203097614dc9864a2  win-arm64/node_pdb.zip
ac51903c4c111815d52280b1fdcc8da067cbb37e2fe1a765097b85c3292c8582  win-x64/node.exe
589684168a73547ca47cd22d76a4e465ef561abe89fb1b2b23fe35bbe857d505  win-x64/node.lib
50155c3c9afe1c3ce9a57a8763ed421acc72845c2d30f79d93afe73cb65473ef  win-x64/node_pdb.7z
a9970c87747af4ef15524240dc28ebcf64080c7a68e39d2a406b743e438b6a20  win-x64/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQTdeS9Zc8beUsQyy9rHer+gDdvytwUCamomTgAKCRDHer+gDdvy
twyzAQDrLBWmNsaCn+z0wLyVZgHGA4R5wjJcIil2aKvsiiwDgwEAosTcDL1Me9tq
sDclFViJ4DaRM2efOzyjeLKf/qKH+go=
=4N8e
-----END PGP SIGNATURE-----
```
