v22.22.3
nodejs/nodev22.22.3May 13, 2026by marco-ippolito
AI Summary
A security release fixing a potential null pointer dereference in crypto and updating root certificates.
Key Highlights
- Fixes potential null pointer dereference when BIO_meth_new() fails.
- Updates root certificates to NSS 3.121.
Full Release Notes
### Commits * \[[`4f780905c5`](https://github.com/nodejs/node/commit/4f780905c5)] - **crypto**: fix potential null pointer dereference when BIO\_meth\_new() fails (Nora Dossche) [#61788](https://github.com/nodejs/node/pull/61788) * \[[`4a09efb947`](https://github.com/nodejs/node/commit/4a09efb947)] - **crypto**: update root certificates to NSS 3.121 (Node.js GitHub Bot) [#62485](https://github.com/nodejs/node/pull/62485) * \[[`e4c0d99839`](https://github.com/nodejs/node/commit/e4c0d99839)] - **deps**: update timezone to 2026a (Node.js GitHub Bot) [#62164](https://github.com/nodejs/node/pull/62164) * \[[`0226c8dd7a`](https://github.com/nodejs/node/commit/0226c8dd7a)] - **deps**: update simdjson to 4.5.0 (Node.js GitHub Bot) [#62382](https://github.com/nodejs/node/pull/62382) * \[[`e742ab748c`](https://github.com/nodejs/node/commit/e742ab748c)] - **deps**: update sqlite to 3.51.3 (Node.js GitHub Bot) [#62256](https://github.com/nodejs/node/pull/62256) * \[[`73cac0571a`](https://github.com/nodejs/node/commit/73cac0571a)] - **deps**: update amaro to 1.1.8 (Node.js GitHub Bot) [#62151](https://github.com/nodejs/node/pull/62151) * \[[`ae5c162b93`](https://github.com/nodejs/node/commit/ae5c162b93)] - **deps**: update amaro to 1.1.7 (Node.js GitHub Bot) [#61730](https://github.com/nodejs/node/pull/61730) * \[[`b819cb9977`](https://github.com/nodejs/node/commit/b819cb9977)] - **deps**: update amaro to 1.1.6 (Node.js GitHub Bot) [#61603](https://github.com/nodejs/node/pull/61603) * \[[`bbcce09dc7`](https://github.com/nodejs/node/commit/bbcce09dc7)] - **deps**: update sqlite to 3.52.0 (Node.js GitHub Bot) [#62150](https://github.com/nodejs/node/pull/62150) * \[[`22ff2d81ce`](https://github.com/nodejs/node/commit/22ff2d81ce)] - **deps**: update simdjson to 4.3.1 (Node.js GitHub Bot) [#61930](https://github.com/nodejs/node/pull/61930) * \[[`f49b51d75c`](https://github.com/nodejs/node/commit/f49b51d75c)] - **deps**: update acorn-walk to 8.3.5 (Node.js GitHub Bot) [#61928](https://github.com/nodejs/node/pull/61928) * \[[`1a5cec0d49`](https://github.com/nodejs/node/commit/1a5cec0d49)] - **deps**: update acorn to 8.16.0 (Node.js GitHub Bot) [#61925](https://github.com/nodejs/node/pull/61925) * \[[`d339497688`](https://github.com/nodejs/node/commit/d339497688)] - **deps**: update nbytes to 0.1.3 (Node.js GitHub Bot) [#61879](https://github.com/nodejs/node/pull/61879) * \[[`3ff8ffd459`](https://github.com/nodejs/node/commit/3ff8ffd459)] - **deps**: remove stale OpenSSL arch configs (René) [#61834](https://github.com/nodejs/node/pull/61834) * \[[`b8ddbc1e9a`](https://github.com/nodejs/node/commit/b8ddbc1e9a)] - **deps**: update llhttp to 9.3.1 (Node.js GitHub Bot) [#61827](https://github.com/nodejs/node/pull/61827) * \[[`ffda97afd4`](https://github.com/nodejs/node/commit/ffda97afd4)] - **deps**: update googletest to 2461743991f9aa53e9a3625eafcbacd81a3c74cd (Node.js GitHub Bot) [#62484](https://github.com/nodejs/node/pull/62484) * \[[`79aa32cf4f`](https://github.com/nodejs/node/commit/79aa32cf4f)] - **deps**: update googletest to 73a63ea05dc8ca29ec1d2c1d66481dd0de1950f1 (Node.js GitHub Bot) [#61927](https://github.com/nodejs/node/pull/61927) * \[[`b6957e13b6`](https://github.com/nodejs/node/commit/b6957e13b6)] - **deps**: update archs files for openssl-3.5.6 (Node.js GitHub Bot) [#62629](https://github.com/nodejs/node/pull/62629) * \[[`3a27669063`](https://github.com/nodejs/node/commit/3a27669063)] - **deps**: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) [#62629](https://github.com/nodejs/node/pull/62629) * \[[`d568a1bb53`](https://github.com/nodejs/node/commit/d568a1bb53)] - **deps**: upgrade npm to 10.9.8 (npm team) [#62463](https://github.com/nodejs/node/pull/62463) * \[[`ec11f3c1d5`](https://github.com/nodejs/node/commit/ec11f3c1d5)] - **deps**: V8: backport 85b390089e51 (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`08609712ed`](https://github.com/nodejs/node/commit/08609712ed)] - **deps**: V8: backport 1b27e4674f11 (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`dcc60d5ab2`](https://github.com/nodejs/node/commit/dcc60d5ab2)] - **deps**: V8: backport 9997fc013952 (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`1d1f4451fb`](https://github.com/nodejs/node/commit/1d1f4451fb)] - **deps**: V8: cherry-pick b96e40d5ac85 (Clemens Backes) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`2268567237`](https://github.com/nodejs/node/commit/2268567237)] - **deps**: V8: cherry-pick 7cb6188cf913 (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`92804cdbea`](https://github.com/nodejs/node/commit/92804cdbea)] - **deps**: V8: cherry-pick e7ccf0af1bdd (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`eae2c27a40`](https://github.com/nodejs/node/commit/eae2c27a40)] - **deps**: V8: cherry-pick 8e214ec3ec8c (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`a1799a49bb`](https://github.com/nodejs/node/commit/a1799a49bb)] - **deps**: V8: backport 63b8849d73ae (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`a2df2d8731`](https://github.com/nodejs/node/commit/a2df2d8731)] - **deps**: V8: backport 323942700cfe (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`e3d65c7dca`](https://github.com/nodejs/node/commit/e3d65c7dca)] - **deps**: V8: backport 89dc6eab605c (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`5e7db133de`](https://github.com/nodejs/node/commit/5e7db133de)] - **deps**: V8: backport 910cb91733dc (Jakob Kummerow) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`d0c24a28af`](https://github.com/nodejs/node/commit/d0c24a28af)] - **deps**: V8: cherry-pick b8f91e510e0f (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`d358687824`](https://github.com/nodejs/node/commit/d358687824)] - **deps**: V8: cherry-pick cf03d55db2a0 (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`67c8b2c349`](https://github.com/nodejs/node/commit/67c8b2c349)] - **deps**: V8: cherry-pick 692f3d526a38 (Sébastien Doeraene) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`71e5a59ffd`](https://github.com/nodejs/node/commit/71e5a59ffd)] - **deps**: V8: cherry-pick c734674e03f9 (Manos Koukoutos) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`f0dbe81c7b`](https://github.com/nodejs/node/commit/f0dbe81c7b)] - **deps**: V8: cherry-pick b2f3aea23a01 (Thibaud Michaud) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`d333f480c3`](https://github.com/nodejs/node/commit/d333f480c3)] - **deps**: V8: cherry-pick 5f1342c20b59 (Matthias Liedtke) [#62783](https://github.com/nodejs/node/pull/62783) * \[[`db722725bb`](https://github.com/nodejs/node/commit/db722725bb)] - **deps**: use npm undici\@six tag in `update-undici.sh` (Matteo Collina) [#63012](https://github.com/nodejs/node/pull/63012) * \[[`9b57979d9c`](https://github.com/nodejs/node/commit/9b57979d9c)] - **doc**: add Rafael to last security release steward (Rafael Gonzaga) [#62423](https://github.com/nodejs/node/pull/62423) * \[[`d8075585bf`](https://github.com/nodejs/node/commit/d8075585bf)] - **doc**: add path to vulnerabilities.json mention (Rafael Gonzaga) [#62355](https://github.com/nodejs/node/pull/62355) * \[[`6ec9a70204`](https://github.com/nodejs/node/commit/6ec9a70204)] - **doc**: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) [#62208](https://github.com/nodejs/node/pull/62208) * \[[`1fc86fcb6e`](https://github.com/nodejs/node/commit/1fc86fcb6e)] - **doc**: add note (and caveat) for `mock.module` about customization hooks (Jacob Smith) [#62075](https://github.com/nodejs/node/pull/62075) * \[[`491be80bd9`](https://github.com/nodejs/node/commit/491be80bd9)] - **doc**: add efekrskl as triager (Efe) [#61876](https://github.com/nodejs/node/pull/61876) * \[[`18558293a3`](https://github.com/nodejs/node/commit/18558293a3)] - **doc**: fix module.stripTypeScriptTypes indentation (René) [#61992](https://github.com/nodejs/node/pull/61992) * \[[`8e20976522`](https://github.com/nodejs/node/commit/8e20976522)] - **doc**: explicitly mention Slack handle (Rafael Gonzaga) [#61986](https://github.com/nodejs/node/pull/61986) * \[[`70b8e6b4fb`](https://github.com/nodejs/node/commit/70b8e6b4fb)] - **doc**: rename invalid `function` parameter (René) [#61942](https://github.com/nodejs/node/pull/61942) * \[[`4045c76f6c`](https://github.com/nodejs/node/commit/4045c76f6c)] - **doc**: clarify status of feature request issues (Antoine du Hamel) [#61505](https://github.com/nodejs/node/pull/61505) * \[[`c54652f2aa`](https://github.com/nodejs/node/commit/c54652f2aa)] - **doc**: remove incorrect mention of `module` in `typescript.md` (Rob Palmer) [#61839](https://github.com/nodejs/node/pull/61839) * \[[`9fad6cedf5`](https://github.com/nodejs/node/commit/9fad6cedf5)] - **doc**: clarify async caveats for `events.once()` (René) [#61572](https://github.com/nodejs/node/pull/61572) * \[[`2f1e5733fe`](https://github.com/nodejs/node/commit/2f1e5733fe)] - **doc**: update Juan's security steward info (Juan José) [#61754](https://github.com/nodejs/node/pull/61754) * \[[`a64bdb5068`](https://github.com/nodejs/node/commit/a64bdb5068)] - **doc**: fix overstated Date header requirement in response.sendDate (Kit Dallege) [#62206](https://github.com/nodejs/node/pull/62206) * \[[`02797de923`](https://github.com/nodejs/node/commit/02797de923)] - **doc**: fix small environment\_variables typo (chris) [#62279](https://github.com/nodejs/node/pull/62279) * \[[`f22ebdc809`](https://github.com/nodejs/node/commit/f22ebdc809)] - **doc**: fix small logic error in DETECT\_MODULE\_SYNTAX (René) [#62025](https://github.com/nodejs/node/pull/62025) * \[[`9f4508062a`](https://github.com/nodejs/node/commit/9f4508062a)] - **doc**: fix methods being documented as properties in `process.md` (Antoine du Hamel) [#61765](https://github.com/nodejs/node/pull/61765) * \[[`3ea39ff135`](https://github.com/nodejs/node/commit/3ea39ff135)] - **doc**: fix dropdown menu being obscured at <600px due to stacking context (Jeff) [#61735](https://github.com/nodejs/node/pull/61735) * \[[`c22445079b`](https://github.com/nodejs/node/commit/c22445079b)] - **doc**: fix spacing in process message event (Aviv Keller) [#61756](https://github.com/nodejs/node/pull/61756) * \[[`32831b5223`](https://github.com/nodejs/node/commit/32831b5223)] - **doc**: fix broken links of net.md (YuSheng Chen) [#61673](https://github.com/nodejs/node/pull/61673) * \[[`005508d509`](https://github.com/nodejs/node/commit/005508d509)] - **doc**: remove obsolete Boxstarter automated install (Mike McCready) [#61785](https://github.com/nodejs/node/pull/61785) * \[[`37c2fd6f7d`](https://github.com/nodejs/node/commit/37c2fd6f7d)] - **esm**: fix path normalization in `finalizeResolution` (Antoine du Hamel) [#62080](https://github.com/nodejs/node/pull/62080) * \[[`1769d74613`](https://github.com/nodejs/node/commit/1769d74613)] - **esm**: populate separate cache for require(esm) in imported CJS (Joyee Cheung) [#59679](https://github.com/nodejs/node/pull/59679) * \[[`ee02966ffc`](https://github.com/nodejs/node/commit/ee02966ffc)] - **http**: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) [#61710](https://github.com/nodejs/node/pull/61710) * \[[`2fdb5ce6cc`](https://github.com/nodejs/node/commit/2fdb5ce6cc)] - **http2**: fix FileHandle leak in respondWithFile (sangwook) [#61707](https://github.com/nodejs/node/pull/61707) * \[[`aa2c1eca04`](https://github.com/nodejs/node/commit/aa2c1eca04)] - **lib**: fix source map url parse in dynamic imports (Chengzhong Wu) [#61990](https://github.com/nodejs/node/pull/61990) * \[[`785b00cbeb`](https://github.com/nodejs/node/commit/785b00cbeb)] - **meta**: pass release version to release worker (flakey5) [#62777](https://github.com/nodejs/node/pull/62777) * \[[`447fb9a0b5`](https://github.com/nodejs/node/commit/447fb9a0b5)] - **meta**: persist sccache daemon until end of build workflows (René) [#61639](https://github.com/nodejs/node/pull/61639) * \[[`5065a0acb3`](https://github.com/nodejs/node/commit/5065a0acb3)] - **module**: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) [#61529](https://github.com/nodejs/node/pull/61529) * \[[`9a2e21305d`](https://github.com/nodejs/node/commit/9a2e21305d)] - **module**: do not wrap module.\_load when tracing is not enabled (Joyee Cheung) [#61479](https://github.com/nodejs/node/pull/61479) * \[[`b9240bc063`](https://github.com/nodejs/node/commit/b9240bc063)] - **module**: fix sync resolve hooks for require with node: prefixes (Joyee Cheung) [#61088](https://github.com/nodejs/node/pull/61088) * \[[`2e91b28aaf`](https://github.com/nodejs/node/commit/2e91b28aaf)] - **module**: handle null source from async loader hooks in sync hooks (Joyee Cheung) [#59929](https://github.com/nodejs/node/pull/59929) * \[[`39147c154e`](https://github.com/nodejs/node/commit/39147c154e)] - **module**: use sync cjs when importing cts (Marco Ippolito) [#60072](https://github.com/nodejs/node/pull/60072) * \[[`12a2462b2c`](https://github.com/nodejs/node/commit/12a2462b2c)] - **module**: only put directly require-d ESM into require.cache (Joyee Cheung) [#59874](https://github.com/nodejs/node/pull/59874) * \[[`cf39566277`](https://github.com/nodejs/node/commit/cf39566277)] - **src**: fix flags argument offset in JSUdpWrap (Weixie Cui) [#61948](https://github.com/nodejs/node/pull/61948) * \[[`578a9a9230`](https://github.com/nodejs/node/commit/578a9a9230)] - **src**: clamp WriteUtf8 capacity to INT\_MAX in EncodeInto (semimikoh) [#62621](https://github.com/nodejs/node/pull/62621) * \[[`57c3035fec`](https://github.com/nodejs/node/commit/57c3035fec)] - **stream**: fix decoded fromList chunk boundary check (Thomas Watson) [#61884](https://github.com/nodejs/node/pull/61884) * \[[`57fb008bb8`](https://github.com/nodejs/node/commit/57fb008bb8)] - **test**: update tls junk data error expectations (Filip Skokan) [#62629](https://github.com/nodejs/node/pull/62629) * \[[`363f9a9d18`](https://github.com/nodejs/node/commit/363f9a9d18)] - **test**: skip `test-url` on `--shared-ada` builds (Antoine du Hamel) [#62019](https://github.com/nodejs/node/pull/62019) * \[[`daaead342b`](https://github.com/nodejs/node/commit/daaead342b)] - **test**: simplify encodeInto large buffer regression test (semimikoh) [#62621](https://github.com/nodejs/node/pull/62621) * \[[`ecfa766b41`](https://github.com/nodejs/node/commit/ecfa766b41)] - **tools**: fix auto-start-ci (Antoine du Hamel) [#61900](https://github.com/nodejs/node/pull/61900) * \[[`17c0a610af`](https://github.com/nodejs/node/commit/17c0a610af)] - **tools**: fix parsing of commit trailers in `lint-release-proposal` GHA (Antoine du Hamel) [#62077](https://github.com/nodejs/node/pull/62077) * \[[`89ad7dc63b`](https://github.com/nodejs/node/commit/89ad7dc63b)] - **tools**: enforce removal of `lts-watch-*` labels on release proposals (Antoine du Hamel) [#61672](https://github.com/nodejs/node/pull/61672) * \[[`5f9bb8ef0c`](https://github.com/nodejs/node/commit/5f9bb8ef0c)] - **tools**: revert tools GHA workflow to ubuntu-latest (Richard Lau) [#62024](https://github.com/nodejs/node/pull/62024) * \[[`977ef80ac1`](https://github.com/nodejs/node/commit/977ef80ac1)] - **url**: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) [#62574](https://github.com/nodejs/node/pull/62574) * \[[`ad8f518a81`](https://github.com/nodejs/node/commit/ad8f518a81)] - **zlib**: fix use-after-free when reset() is called during write (Matteo Collina) [#62325](https://github.com/nodejs/node/pull/62325)