Node.js 20.20.2 (LTS)

Marco Ippolito

2026-03-24, Version 20.20.2 'Iron' (LTS), @marco-ippolito

This is a security release.

Notable Changes

(CVE-2026-21717) fix array index hash collision (Joyee Cheung) https://github.com/nodejs-private/node-private/pull/834
(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) https://github.com/nodejs-private/node-private/pull/822
(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) https://github.com/nodejs-private/node-private/pull/821
(CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) https://github.com/nodejs-private/node-private/pull/795
(CVE-2026-21715) add permission check to realpath.native (RafaelGSS) https://github.com/nodejs-private/node-private/pull/794
(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) https://github.com/nodejs-private/node-private/pull/832
(CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) https://github.com/nodejs-private/node-private/pull/819

Commits

[cfb51fa9ce] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#831
[f333d0be5f] - deps: V8: override depot_tools version (Richard Lau) #62344
[2acd5d1226] - deps: update undici to v6.24.1 (Matteo Collina) #62285
[af5c144ebc] - (CVE-2026-21717) deps,build,test: fix array index hash collision (Joyee Cheung) nodejs-private/node-private#834
[00ad47a28e] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821
[0123309566] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#840
[00830712bc] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#838
[a0c73425da] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832
[cc3f294507] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#839

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

3c60f54069a53ad8ffeef2b0f11e1f88333b12decfed755b26ce3fcb5e2d97e4  node-v20.20.2-aix-ppc64.tar.gz
1473f48d689627ec35eb4147d0f22ee60c694f16719c20a7c129b925c60f3a2f  node-v20.20.2-arm64.msi
466e05f3477c20dfb723054dfebffe55bc74660ee77f612166fca121dacb65b6  node-v20.20.2-darwin-arm64.tar.gz
6375a1d4421bc04ab284ba89459df788a78c49c89e83c463d0eede47e2efc07b  node-v20.20.2-darwin-arm64.tar.xz
8be6f5e4bb128c82774f8a0b8d7a1cc1365a7977d9657cece0ca647b3fe04e61  node-v20.20.2-darwin-x64.tar.gz
4d4c020eb534497e616de38f3733289ff33c615ddab38c048edec6547b7f76ea  node-v20.20.2-darwin-x64.tar.xz
6de0e836efa9f32512e61db3dfd08b3d97a015b7e828d1a5efdf281a56a692d9  node-v20.20.2-headers.tar.gz
46573741c48c20c6bcfc71450e2fc56b4d1156d72c3d6cc9917fa8b1cbc6e836  node-v20.20.2-headers.tar.xz
47ef73d543ecf6eb19435f6c03a0ac4809b3bf0dd6b26c7c571efc2a6572a74d  node-v20.20.2-linux-arm64.tar.gz
73093db209e4e9e09dd7d15a47aeaab1b74833830df03efa5f942a1122c5fa71  node-v20.20.2-linux-arm64.tar.xz
8e15f121e721c9354132053188d4c1a18ea9e345c019ee440fb256e3dda7df15  node-v20.20.2-linux-armv7l.tar.gz
f704ce75d9a194c30c378049b516000e49612c2f046ac83c7435eb33ec2926f0  node-v20.20.2-linux-armv7l.tar.xz
5f2fd0e0cd67aeac0db800b334151cae6ea70ea337487b26f79ac90e3fe126e1  node-v20.20.2-linux-ppc64le.tar.gz
4ee91307b3b517f880cd63d3f75fc91f4afc926ad9447661b755d50060ba2816  node-v20.20.2-linux-ppc64le.tar.xz
ee1ca1193e75a6d31b6007c575deca11b116e84a6bda136ae0e0dbe19399889c  node-v20.20.2-linux-s390x.tar.gz
00590e7e1295d265fd22706e10467c03ecf170873b76c1835ff74b47b90ce6e0  node-v20.20.2-linux-s390x.tar.xz
19e56f0825510207dd904f087fe52faa0a4eb6b2aab5f0ea7a33830d04888b8b  node-v20.20.2-linux-x64.tar.gz
df770b2a6f130ed8627c9782c988fda9669fa23898329a61a871e32f965e007d  node-v20.20.2-linux-x64.tar.xz
63be4e81a9248c5a5ff5f4a67efffef6a4eaa976f5c7fb0b93027db36342e9a3  node-v20.20.2.pkg
8cb85a81f75169eb811f7b2512cf17a646826430debbe016a7461f31e286fdef  node-v20.20.2.tar.gz
7aeeacdb858299e09a3e0510d4bb8b266923894a9e3ac0058ba89d4ecf4a4cca  node-v20.20.2.tar.xz
f066ba3f80363f8e16a2737a945052ea910733f22c93821519f53667614bafd0  node-v20.20.2-win-arm64.7z
d5c5b1d56f7f9469830eb1f57efeec0a6a9078c0a9e88cd5b4b4b48f46c22069  node-v20.20.2-win-arm64.zip
1bbbfd0312335a95e86642c3beef98bb84def4cca85cd879f3da0baca6797422  node-v20.20.2-win-x64.7z
dc3700fdd57a63eedb8fd7e3c7baaa32e6a740a1b904167ff4204bc68ed8bf77  node-v20.20.2-win-x64.zip
4103cb79dba8c0272e309f8b337c2240369fcba5454bf10c2c4b23932a3c6033  node-v20.20.2-win-x86.7z
cd34d5da2f36ebd84ed57252756ee512447db4502d9f9e38ca8dccb511b0b352  node-v20.20.2-win-x86.zip
9a283dcdb771793d6492235e81f3fc80048db8a37497a0af87b0a9f450d10fa6  node-v20.20.2-x64.msi
5bd11635c4d46a14e5f712ffbddf07a8dc01d6e62c5ac1d20cab47b4fd7f5ce0  node-v20.20.2-x86.msi
a6c4adc2ea22256b5d2df57a981f1538d56d44fc845646a8bdbf66740ac1e948  win-arm64/node.exe
deacf784c804e5ab9df886b2de4c7a04d77ee1c722e2e4f1567aac62391ec4c4  win-arm64/node.lib
46512faa28642586c97e61b1a1431bc0a3b2a85e1d63a22794df3b7ebf8d4cfd  win-arm64/node_pdb.7z
9a6ba8c56d58883584a27f861c784f203455e9ae4dd882836b16980c95dfa84c  win-arm64/node_pdb.zip
56c1520ee33b801e8bdb92fb321cf2e98529735b6d12bd4a2a6dec0ac0bab937  win-x64/node.exe
c4a794e993d9304238523230885e9ec00ca052c73b9558471858eef14916d91f  win-x64/node.lib
e190b1166cce167651d3bd544881420e4642ef2dfc643da0023dee9f91f44046  win-x64/node_pdb.7z
656f2062e5cb3057651381d0916ad79b9e2113625572a0745b70bc6844e4196a  win-x64/node_pdb.zip
33379026333558256e5f467d80c67ba20f6b8e77e8d3ab72ad4dc005f6e11845  win-x86/node.exe
962e762b899969e773dc1163d53f1dca10a7769d73217b727a94574d2613355b  win-x86/node.lib
a1f7bfe7e5536488b9270f1c1ea1d5b259753b7ee89dabf8eaabc59bfc26fb60  win-x86/node_pdb.7z
f9d592b4c57c9749d33570e80f6d63c4aaa2441fb86347c25b81d988c5955889  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEzGj1oxBv9EgyLkjtJ/XjjVsKIV8FAmnC9VIACgkQJ/XjjVsK
IV//Pw//am3VN5wTtH+XMPNIyiFk7yrJPYKFhUPchoYVhKSjmnbdD6zn8F4n5KO6
t3P5mORXBai0GDBZA219moPX4CpBlVMDWUm87SPndc2nzS0PiGn/9b2vBOYErvel
lGPVaRq6MYE4mTKLIFBoApjJ5mBPPWWnzPOgB0nRw08Uv4rjWS88P4R7qohz2+V0
L/Szen1f/9F3ev9mGpFXlx4ylNww0ZDu0uJySweZEJE/9s5fq1EkGNQA4zpYpnyU
oqWHcL7ugQI7/2pQbUYk2W8WXTLi8bBuzjmP6mqetXDzltwchjtB8tmZhBqTKtPP
QrS0EcS3POe3hrriuqbm/VarpoRiOgexAG4YuzAMIldcSxNYMteSiP95WvPUfa9i
R7gcZ3KVyOVTtXUTTTqLWQrmzFeDmJNm1Y2n3B+mhKub8PuDwOMbvb77IoV51Azu
NpFSA+QmosLN3G/ydJI4L4JDme9MaYHPRSmBvEMryvpqNWjVoUn8OkHlmgGGreFu
QjyfxBzpYXkxkUHHt68wgIC/odUMxuiBWzLQ3pDlKgnR4bLL/uc+GnzXR6JES71X
NhZAwfLVFTQSBd6oq1ibU1SEObAVe4cIQEezwqT0qy2WFiyikXlgCNRHYtSPtjsf
A5s7j3cE8/naM28vHrt3kLmLIb5Gik5SL+N4Hig18vwKCyk+KkI=
=CXge
-----END PGP SIGNATURE-----

Node.js 25.8.1 (Current)