@@ -0,0 +1,132 @@
+---
+date: '2026-10-21T10:39:12.420Z'
+category: release
+title: Node.js 22.23.4 (LTS)
+layout: blog-post
+author: Antoine du Hamel
+---
+
+## 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95
+
+This is a security release.
+
+### Notable Changes
+
+- (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
+- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
+- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
+- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
+- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
+- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
+- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
+- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
+- deps: update timezone to 2026e (Node.js GitHub Bot)
+- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
+- deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
+- deps: update undici to 6.29.1 (Node.js GitHub Bot)
+
+### Commits
+
+- \[[`68fa0df6d6`](https://github.com/nodejs/node/commit/68fa0df6d6)] - **crypto**: update root certificates to NSS 3.131.1 (Antoine du Hamel) [#66877](https://github.com/nodejs/node/pull/66877)
+- \[[`dd6b47573b`](https://github.com/nodejs/node/commit/dd6b47573b)] - **crypto**: reset random caches across snapshots (Filip Skokan) [nodejs-private/node-private#987](https://github.com/nodejs-private/node-private/pull/987)
+- \[[`a62b7d5362`](https://github.com/nodejs/node/commit/a62b7d5362)] - **crypto**: harden X.509 conversion and formatting (Filip Skokan) [nodejs-private/node-private#966](https://github.com/nodejs-private/node-private/pull/966)
+- \[[`ec9e5e4a3e`](https://github.com/nodejs/node/commit/ec9e5e4a3e)] - **crypto**: update root certificates to NSS 3.129 (Node.js GitHub Bot) [#66496](https://github.com/nodejs/node/pull/66496)
+- \[[`a538a9515d`](https://github.com/nodejs/node/commit/a538a9515d)] - **deps**: update c-ares to 1.34.9 (Node.js GitHub Bot) [#66868](https://github.com/nodejs/node/pull/66868)
+- \[[`67d294739f`](https://github.com/nodejs/node/commit/67d294739f)] - **deps**: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002)
+- \[[`1ab9db8a74`](https://github.com/nodejs/node/commit/1ab9db8a74)] - **deps**: update timezone to 2026e (Node.js GitHub Bot) [#66419](https://github.com/nodejs/node/pull/66419)
+- \[[`52b4bcab03`](https://github.com/nodejs/node/commit/52b4bcab03)] - **deps**: update timezone to 2026d (Node.js GitHub Bot) [#66333](https://github.com/nodejs/node/pull/66333)
+- \[[`60f4833d41`](https://github.com/nodejs/node/commit/60f4833d41)] - **deps**: update archs files for openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396)
+- \[[`05470dc308`](https://github.com/nodejs/node/commit/05470dc308)] - **deps**: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) [#66396](https://github.com/nodejs/node/pull/66396)
+- \[[`47333fe4f4`](https://github.com/nodejs/node/commit/47333fe4f4)] - **deps**: update sqlite to 3.53.4 (Node.js GitHub Bot) [#64745](https://github.com/nodejs/node/pull/64745)
+- \[[`98258b855f`](https://github.com/nodejs/node/commit/98258b855f)] - **deps**: update sqlite to 3.53.3 (Node.js GitHub Bot) [#64180](https://github.com/nodejs/node/pull/64180)
+- \[[`a8349b6408`](https://github.com/nodejs/node/commit/a8349b6408)] - **deps**: update sqlite to 3.53.2 (Node.js GitHub Bot) [#63774](https://github.com/nodejs/node/pull/63774)
+- \[[`e9e295bcc1`](https://github.com/nodejs/node/commit/e9e295bcc1)] - **deps**: cherry-pick e807d4e379 from SQLite (Junsu Han) [#63525](https://github.com/nodejs/node/pull/63525)
+- \[[`512a9b61f0`](https://github.com/nodejs/node/commit/512a9b61f0)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#63217](https://github.com/nodejs/node/pull/63217)
+- \[[`e708247254`](https://github.com/nodejs/node/commit/e708247254)] - **deps**: update sqlite to 3.53.0 (Node.js GitHub Bot) [#62699](https://github.com/nodejs/node/pull/62699)
+- \[[`857be5afa3`](https://github.com/nodejs/node/commit/857be5afa3)] - **deps**: update undici to 6.29.1 (Node.js GitHub Bot) [#66765](https://github.com/nodejs/node/pull/66765)
+- \[[`19c5056002`](https://github.com/nodejs/node/commit/19c5056002)] - **dns**: validate resolve inputs for null bytes (James M Snell) [nodejs-private/node-private#984](https://github.com/nodejs-private/node-private/pull/984)
+- \[[`e7b2985d59`](https://github.com/nodejs/node/commit/e7b2985d59)] - **http**: ensure agent data guard works without I/O (James M Snell) [nodejs-private/node-private#983](https://github.com/nodejs-private/node-private/pull/983)
+- \[[`50ab804edc`](https://github.com/nodejs/node/commit/50ab804edc)] - **permission**: check permission model in realpathSync (RafaelGSS) [nodejs-private/node-private#973](https://github.com/nodejs-private/node-private/pull/973)
+- \[[`a18ec92752`](https://github.com/nodejs/node/commit/a18ec92752)] - **src**: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) [nodejs-private/node-private#1002](https://github.com/nodejs-private/node-private/pull/1002)
+- \[[`4342503fd8`](https://github.com/nodejs/node/commit/4342503fd8)] - **tls**: reject chains containing blocked public keys (Ulises Gascon) [#66871](https://github.com/nodejs/node/pull/66871)
+- \[[`d7663560ac`](https://github.com/nodejs/node/commit/d7663560ac)] - **tls**: reject non-canonical IP addresses (Matteo Collina) [nodejs-private/node-private#982](https://github.com/nodejs-private/node-private/pull/982)
+- \[[`beb4cd4cd3`](https://github.com/nodejs/node/commit/beb4cd4cd3)] - **tls**: match IPv6 hosts against IP-Address SANs (Pascal Garber) [#64145](https://github.com/nodejs/node/pull/64145)
+- \[[`4b42e56aaf`](https://github.com/nodejs/node/commit/4b42e56aaf)] - **tools**: retry Gatekeeper check and stapling after notarization (Ryan Aslett) [#66855](https://github.com/nodejs/node/pull/66855)
+
+Windows 32-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-x86.msi \
+Windows 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-x64.msi \
+Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4-arm64.msi \
+Windows 32-bit Binary: https://nodejs.org/dist/v22.23.4/win-x86/node.exe \
+Windows 64-bit Binary: https://nodejs.org/dist/v22.23.4/win-x64/node.exe \
+Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.23.4/win-arm64/node.exe \
+macOS 64-bit Installer: https://nodejs.org/dist/v22.23.4/node-v22.23.4.pkg \
+macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-darwin-arm64.tar.gz \
+macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-darwin-x64.tar.gz \
+Linux 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-x64.tar.xz \
+Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-ppc64le.tar.xz \
+Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-s390x.tar.xz \
+AIX 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-aix-ppc64.tar.gz \
+ARMv7 32-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-armv7l.tar.xz \
+ARMv8 64-bit Binary: https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-arm64.tar.xz \
+Source Code: https://nodejs.org/dist/v22.23.4/node-v22.23.4.tar.gz \
+Other release files: https://nodejs.org/dist/v22.23.4/ \
+Documentation: https://nodejs.org/docs/v22.23.4/api/
+
+### SHASUMS
+
+```
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+c219410bea0aed08ecfa5847a3d8aca4e45dd494a094f86c0d8721138360a9c9  node-v22.23.4-aix-ppc64.tar.gz
+49edbb15812c13efa061c2c76b06944425f3711454845e78b625a8e865a45327  node-v22.23.4-arm64.msi
+c9e1dbc748b33ed2d14f42445191ecaf14c56259c7a9a26d0042c49ec2b66428  node-v22.23.4-darwin-arm64.tar.gz
+037650d0839f457747396f052073fb48333d31bf5abd3c98b74da20d89ebb1ad  node-v22.23.4-darwin-arm64.tar.xz
+efcc2b0db6f94bf53eddb038fe2b370277a042bd29e4f19b8f8e23598795b819  node-v22.23.4-darwin-x64.tar.gz
+f42abca7aaac61efc57d49fb42ea84fc53bbeba9a749cb03a291ce6e4e7a69c1  node-v22.23.4-darwin-x64.tar.xz
+dc4028dc105e27e5295119dd9da076fca71d5216113e097813f0fb30f59241a5  node-v22.23.4-headers.tar.gz
+00615892b14ca159775ccb96d5696fdfeeea9804740fc8c5c1064eac09456a0e  node-v22.23.4-headers.tar.xz
+f7a1e486dbc8b286847815b477d4fb5e9fb963ed4489c3e1588853d685f589f9  node-v22.23.4-linux-arm64.tar.gz
+6287aa46b6c375d816e63ae66d024fbbfd70404825aabdfdf898a970871d2f4b  node-v22.23.4-linux-arm64.tar.xz
+4318e0c68f62e18583dae85eb645f55c7f2b8a2e8d1fffe91a2e8abd046880ab  node-v22.23.4-linux-armv7l.tar.gz
+c9057c6a3b8fbb9651ed115c1e96d4a7281b7b9c9ca89fa05865c98ed7ffd437  node-v22.23.4-linux-armv7l.tar.xz
+6684903ee2795aafe639dc07203e8a51ed20ae161cf21b6da7c213c8abfed442  node-v22.23.4-linux-ppc64le.tar.gz
+e4732f45e0cad787d6ba70c4eb6db45dbdb3f286f67dee429dbc6b4ff36eac43  node-v22.23.4-linux-ppc64le.tar.xz
+0bdc80fa27331e7f416d1d8553b9aabbc3c158709dc32859e4e85724ac1ac302  node-v22.23.4-linux-s390x.tar.gz
+07ae074fc218fc42e24c939df0dc0209443fb08eb5b2ed6d26b1bf6757781fff  node-v22.23.4-linux-s390x.tar.xz
+63189402eaa222aabf51b4983e512592131cd2d4a9efc3ad9bf291fe74e3e4de  node-v22.23.4-linux-x64-musl.tar.gz
+38355b952f0392b91703d38a0d9af84eb0ff77d69828ca4bc8cc3bc3af80a720  node-v22.23.4-linux-x64-musl.tar.xz
+b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406  node-v22.23.4-linux-x64.tar.gz
+1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce  node-v22.23.4-linux-x64.tar.xz
+2095e4e478f01cfc1cd3784482bbb5bc67feab9bb21336b8934718bfc0f3b435  node-v22.23.4.pkg
+4dd79de8cdc85d65cb32f48a75aee1067bf00bf94b96ecc8e4c2f82f6f0272c2  node-v22.23.4.tar.gz
+7b9adc82d612d0a2a863d96c46de2292552e250cee51956ebbe0146c42aacae9  node-v22.23.4.tar.xz
+a31b4be40d29f457dcd818563f2a3cf77f1ca35a15d3477cab38b3cc6d3a426a  node-v22.23.4-win-arm64.7z
+a8b8cd79cbbb3062435f449591d98dd63730bbbf30ce2d7cc3a6376c236cb111  node-v22.23.4-win-arm64.zip
+010e51ccdd453d747ca67bfe8dda2c5da82540fa896ce2527f286d549574f975  node-v22.23.4-win-x64.7z
+cbc74b5e0982c9dbb41525fd8fb5dcd32fbee237863f7829072f4639a1ce5f20  node-v22.23.4-win-x64.zip
+b393001b81f7d478863394692bb57d28c0afe399fabbab3bce6016bb1cfa181f  node-v22.23.4-win-x86.7z
+7d6c4dce2ecccca46e3c4b3e43c8bebbd1969bd616fdb4fda1e8269171d9ccea  node-v22.23.4-win-x86.zip
+ca9303d3a12e8bec6de829fcb7812fc776930e0ce5c030328a24984ef928427e  node-v22.23.4-x64.msi
+c2a76d76eda52b7930b51fd490264c2fe34a094c04ae721bb71893f3fd6cd1d0  node-v22.23.4-x86.msi
+64d9f6e69b4703870e8cd30a3477127df8b683ea04feb03660e439396549042a  win-arm64/node.exe
+5378f5bad777b4929d1cd4f58974e0ef03815ce5c159863f1875c4b434460c27  win-arm64/node.lib
+8ad8a3ad402d8cf3bc760bf8ad03c85996ae6676a93407b6f06320ef5e981387  win-arm64/node_pdb.7z
+4f94c9c8ab6a3ca4003e41ae226f191cb9ae837312d1390c14db94771a5abc94  win-arm64/node_pdb.zip
+dccc52de28d8df2ee22d2062424f8c563070d95d8ad70c54c4bf01d590dec14f  win-x64/node.exe
+c243185f2347870cadb637c909bf123fc703dc65dbfa769b17ec45a4b661d782  win-x64/node.lib
+c8496e103ee832fb8daf21af22b418c88558956457b9d850e95f78baf7f779cd  win-x64/node_pdb.7z
+426d3e46b15a918c561a15c2c99610d8edac752a406cf0b573809add0ff96f5d  win-x64/node_pdb.zip
+aa39a7741f62832ea50daba0113c8f8b12ccde226abca931326832d5bc47d31f  win-x86/node.exe
+eff47cc18fe2d3e40886cd49f04a85134681657d8b0f2afc55f363743cf6ddd7  win-x86/node.lib
+2f5fcf07c631cff056ba53d4d8fb71d33d6302e243b7b267bfe3e226a3d76193  win-x86/node_pdb.7z
+8aff266913d43a87103ebe02a4631148491b987ac2f70c6f3c95cf7e160de264  win-x86/node_pdb.zip
+
+-----BEGIN PGP SIGNATURE-----
+
+iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCatiU6AAKCRAgsaOQsWjT
+VnXQAQDr+PrTYZtsgzxkf4LjsVlHCaVc9S8q5J1wHIcaNniLrwD/SCaZV98GQixc
+dMdWJU0vUeZgB8Szb/eD1b3hcZmG3AY=
+=vuXb
+-----END PGP SIGNATURE-----
+```