|
| 1 | +--- |
| 2 | +date: '2026-01-13T13:56:13.880Z' |
| 3 | +category: release |
| 4 | +title: Node.js 20.20.0 (LTS) |
| 5 | +layout: blog-post |
| 6 | +author: Marco Ippolito |
| 7 | +--- |
| 8 | + |
| 9 | +## 2026-01-13, Version 20.20.0 'Iron' (LTS), @marco-ippolito |
| 10 | + |
| 11 | +This is a security release. |
| 12 | + |
| 13 | +### Notable Changes |
| 14 | + |
| 15 | +lib: |
| 16 | + |
| 17 | +- (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/802> |
| 18 | +- (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/797> |
| 19 | + lib,permission: |
| 20 | +- (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/760> |
| 21 | + src: |
| 22 | +- (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) <https://github.com/nodejs-private/node-private/pull/773> |
| 23 | + src,lib: |
| 24 | +- (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) <https://github.com/nodejs-private/node-private/pull/759> |
| 25 | + tls: |
| 26 | +- (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) <https://github.com/nodejs-private/node-private/pull/796> |
| 27 | + |
| 28 | +### Commits |
| 29 | + |
| 30 | +- \[[`8f9ba3f623`](https://github.com/nodejs/node/commit/8f9ba3f623)] - **deps**: update c-ares to v1.34.6 (Node.js GitHub Bot) [#60997](https://github.com/nodejs/node/pull/60997) |
| 31 | +- \[[`97fc9b0eb7`](https://github.com/nodejs/node/commit/97fc9b0eb7)] - **deps**: update undici to 6.23.0 (Matteo Collina) [nodejs-private/node-private#792](https://github.com/nodejs-private/node-private/pull/792) |
| 32 | +- \[[`14fbbb510c`](https://github.com/nodejs/node/commit/14fbbb510c)] - **(CVE-2025-55132)** **lib**: disable futimes when permission model is enabled (RafaelGSS) [nodejs-private/node-private#802](https://github.com/nodejs-private/node-private/pull/802) |
| 33 | +- \[[`1febc48d5b`](https://github.com/nodejs/node/commit/1febc48d5b)] - **(CVE-2025-59465)** **lib**: add TLSSocket default error handler (RafaelGSS) [nodejs-private/node-private#797](https://github.com/nodejs-private/node-private/pull/797) |
| 34 | +- \[[`494f62dc23`](https://github.com/nodejs/node/commit/494f62dc23)] - **(CVE-2025-55130)** **lib,permission**: require full read and write to symlink APIs (RafaelGSS) [nodejs-private/node-private#760](https://github.com/nodejs-private/node-private/pull/760) |
| 35 | +- \[[`d7a5c587c0`](https://github.com/nodejs/node/commit/d7a5c587c0)] - **(CVE-2025-59466)** **src**: rethrow stack overflow exceptions in async_hooks (Matteo Collina) [nodejs-private/node-private#773](https://github.com/nodejs-private/node-private/pull/773) |
| 36 | +- \[[`51f4de4b4a`](https://github.com/nodejs/node/commit/51f4de4b4a)] - **(CVE-2025-55131)** **src,lib**: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) [nodejs-private/node-private#759](https://github.com/nodejs-private/node-private/pull/759) |
| 37 | +- \[[`85f73e7057`](https://github.com/nodejs/node/commit/85f73e7057)] - **(CVE-2026-21637)** **tls**: route callback exceptions through error handlers (Matteo Collina) [nodejs-private/node-private#796](https://github.com/nodejs-private/node-private/pull/796) |
| 38 | + |
| 39 | +Windows 32-bit Installer: https://nodejs.org/dist/v20.20.0/node-v20.20.0-x86.msi \ |
| 40 | +Windows 64-bit Installer: https://nodejs.org/dist/v20.20.0/node-v20.20.0-x64.msi \ |
| 41 | +Windows ARM 64-bit Installer: https://nodejs.org/dist/v20.20.0/node-v20.20.0-arm64.msi \ |
| 42 | +Windows 32-bit Binary: https://nodejs.org/dist/v20.20.0/win-x86/node.exe \ |
| 43 | +Windows 64-bit Binary: https://nodejs.org/dist/v20.20.0/win-x64/node.exe \ |
| 44 | +Windows ARM 64-bit Binary: https://nodejs.org/dist/v20.20.0/win-arm64/node.exe \ |
| 45 | +macOS 64-bit Installer: https://nodejs.org/dist/v20.20.0/node-v20.20.0.pkg \ |
| 46 | +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v20.20.0/node-v20.20.0-darwin-arm64.tar.gz \ |
| 47 | +macOS Intel 64-bit Binary: https://nodejs.org/dist/v20.20.0/node-v20.20.0-darwin-x64.tar.gz \ |
| 48 | +Linux 64-bit Binary: https://nodejs.org/dist/v20.20.0/node-v20.20.0-linux-x64.tar.xz \ |
| 49 | +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v20.20.0/node-v20.20.0-linux-ppc64le.tar.xz \ |
| 50 | +Linux s390x 64-bit Binary: https://nodejs.org/dist/v20.20.0/node-v20.20.0-linux-s390x.tar.xz \ |
| 51 | +AIX 64-bit Binary: https://nodejs.org/dist/v20.20.0/node-v20.20.0-aix-ppc64.tar.gz \ |
| 52 | +ARMv7 32-bit Binary: https://nodejs.org/dist/v20.20.0/node-v20.20.0-linux-armv7l.tar.xz \ |
| 53 | +ARMv8 64-bit Binary: https://nodejs.org/dist/v20.20.0/node-v20.20.0-linux-arm64.tar.xz \ |
| 54 | +Source Code: https://nodejs.org/dist/v20.20.0/node-v20.20.0.tar.gz \ |
| 55 | +Other release files: https://nodejs.org/dist/v20.20.0/ \ |
| 56 | +Documentation: https://nodejs.org/docs/v20.20.0/api/ |
| 57 | + |
| 58 | +### SHASUMS |
| 59 | + |
| 60 | +``` |
| 61 | +-----BEGIN PGP SIGNED MESSAGE----- |
| 62 | +Hash: SHA256 |
| 63 | +
|
| 64 | +7ae62921fc80ee47ae4e2519661e927b3fa7abf75cdb50458490ef2f0da633e5 node-v20.20.0-aix-ppc64.tar.gz |
| 65 | +988d0f965918d1ff75b125b36ea5866c1000a48389e0d33875602a58c60b409f node-v20.20.0-arm64.msi |
| 66 | +69b98aa4662032ab06bd92216f0aebb2727d7ee4e1eb79ea5787bbbb38af4801 node-v20.20.0-darwin-arm64.tar.gz |
| 67 | +2edefda1cdebc210b27d85698354a2a4c247af0a6fb91d9414ce6251a638e364 node-v20.20.0-darwin-arm64.tar.xz |
| 68 | +69bf9b294dc04e3b97c3d5e4f16b3c634201b7f5f617fb65d93a9a9ac4bec0f0 node-v20.20.0-darwin-x64.tar.gz |
| 69 | +37f82f0718199626056e3694e9f00a5e30c4d1115c0c8649d04a4924a6b95a6f node-v20.20.0-darwin-x64.tar.xz |
| 70 | +fc74b79dcc07df4b9c3ecf8d214aea5908b408f9653e918e6df163683a0e33ce node-v20.20.0-headers.tar.gz |
| 71 | +96c31e0a07b37b0af25e5b02f679149fe1f169c153477192a59884a320b943d5 node-v20.20.0-headers.tar.xz |
| 72 | +2b640b7fc19a1d2f12a226d7dfba9baff2de87cc15db5a3e58bcdb15582ac604 node-v20.20.0-linux-arm64.tar.gz |
| 73 | +752113754a7dddf0622b3740a2b2bec3dbaf1792a18711b55871d76444d8892a node-v20.20.0-linux-arm64.tar.xz |
| 74 | +2fc5f715c05c7a2662044fbfac5edfcb85d419045ecb2dff53b68f3dc4ec81fb node-v20.20.0-linux-armv7l.tar.gz |
| 75 | +68f1945036de7738cb9f46d161ae778a9f96f18f5f5fc2827755f7925d399246 node-v20.20.0-linux-armv7l.tar.xz |
| 76 | +8b02c9b00b551d59bd550e6d92e8131f23668fcc71b0937ac2256ee0754e39a7 node-v20.20.0-linux-ppc64le.tar.gz |
| 77 | +5ec524a988d71f3f265d218f0f1b71d37ddc2864369508e95d32ac7e6c81a781 node-v20.20.0-linux-ppc64le.tar.xz |
| 78 | +154dd8885646253a12532099ccf9485660bc42e4a56bb1483f4e161fb7f10bb9 node-v20.20.0-linux-s390x.tar.gz |
| 79 | +908d4bbeb33eb576a132be6c6cb209ebf0e646da0e71ea42b9d481c778a1117f node-v20.20.0-linux-s390x.tar.xz |
| 80 | +92dfd59fb4837230abba5d6dd717b882ca897e22fde2f9268e1aac2c4bde0f5b node-v20.20.0-linux-x64.tar.gz |
| 81 | +4f48b52acf42130844a3a75e94da0e9629009d09e4101b2304895c24f3fbe609 node-v20.20.0-linux-x64.tar.xz |
| 82 | +8dae9c0d296e86150f9138c0077ef020fb384fd913d1a671baa3663e14367ec0 node-v20.20.0.pkg |
| 83 | +cafc92e90917c17869d982fdff10104c2eb328437ed9bbf03fdda78ebc0accdd node-v20.20.0.tar.gz |
| 84 | +5294d9d2915620e819e6892fd7e545b98d650bad36dae54e6527eaac482add98 node-v20.20.0.tar.xz |
| 85 | +8eb9846f62581364f877109808c7df953d3393022f33f128f954bc4a857366b2 node-v20.20.0-win-arm64.7z |
| 86 | +870693b496d152519af14b30fb1adef47e62233b90aea5e887ea728cd29c037d node-v20.20.0-win-arm64.zip |
| 87 | +5e48cd18cc5dc6cda23b8ad2467223f3f82b0f03b941b7088578ecb7afbda8d4 node-v20.20.0-win-x64.7z |
| 88 | +32f24e1405b113d4e01ad2585c92024df673b6156ef6f43a5469a75bf52c0a5a node-v20.20.0-win-x64.zip |
| 89 | +0af709b32e1ee7d7ce07c87fc64b216afcee3867cc4982ef95cbfa8010ac0e11 node-v20.20.0-win-x86.7z |
| 90 | +d72d2a5b7d944a28eb59e0477bdc0c40b7b0a817bca057d5e882c0e0013590f3 node-v20.20.0-win-x86.zip |
| 91 | +8b8f5cbf7f1800c74e19cef0182bb6b9144e154e57fc01dd945bd36edaf32c65 node-v20.20.0-x64.msi |
| 92 | +93698ab6cca1cbff4ffb545f15078509ae706cfbb9a646449ccfe1c8d7abad4b node-v20.20.0-x86.msi |
| 93 | +9d8337f4cfdfe39383b7eecbda2b84c5997507962d489988fd61f176c14d652c win-arm64/node.exe |
| 94 | +cc64d1a9d5189e05c3f7ca3e3351aa38e0454573d533b636415dacf495f96291 win-arm64/node.lib |
| 95 | +2fa932df38d6f1612154153a9c8c2048596518d5a46c34490f2c3603fc836d94 win-arm64/node_pdb.7z |
| 96 | +cda800fafb789404acbe98548fe1f4e71fbc3889a747eb3fef67155e67b29513 win-arm64/node_pdb.zip |
| 97 | +fda2b2a8857735f7958ba9771a2b24734ff36434e85ae606bcf7744d41d7adc0 win-x64/node.exe |
| 98 | +919d900bb9d589ebbcfda17e6f6e8f6b49d8d6a8d782b6f5efd6b6c6c5f0d1b1 win-x64/node.lib |
| 99 | +922b251451eb2aeb51848e0e67c5aa6d70c47b86d8ac22afcf4240fd445443a5 win-x64/node_pdb.7z |
| 100 | +d9751fb70d3f7af85c0485e841de3645f43b69fc954cc231d9a16d96690c1ba1 win-x64/node_pdb.zip |
| 101 | +9ffb141325064dcd1febc09752bc3ab7b407b25a0483ebcb1e3cacb7906f4c7f win-x86/node.exe |
| 102 | +4e14d97fd24bf99dc322553d817194cc3b956482ee76e073945e82e5d343740a win-x86/node.lib |
| 103 | +06b506294604c0806f09d5aa7b7a10a99d4bf62e2484bba74a7e1fb1499f0944 win-x86/node_pdb.7z |
| 104 | +080cbc5ed5800da6e0e3087176525d29c21020e212bda31fe1bedb9b3a325876 win-x86/node_pdb.zip |
| 105 | +-----BEGIN PGP SIGNATURE----- |
| 106 | +
|
| 107 | +iQIzBAEBCAAdFiEEzGj1oxBv9EgyLkjtJ/XjjVsKIV8FAmlmTfUACgkQJ/XjjVsK |
| 108 | +IV/NdhAAlCoOxOEkcMRWLhMPfqE+3AhOdqBgATPr1C4+9BHLPGAEqcwro2Gf3OyH |
| 109 | +JwZyCPOfmE9Rcx4/3N7nc5KZ5IzdXtcHSdz7JzXfi9aJLzOeZ/U84hXzSJugYbKs |
| 110 | +v3vu6l7jD9sPtpwNo/1nBGsXiE1iLpENyiKdkWneGrQfJpNImGVdY9LlV6f7j9Yl |
| 111 | +/9bL/Lo6rpR4uSDIuyycAITAAoABli/3SnvSP/yqZ/WPQpA6kO+ZKz1mppAw8zqT |
| 112 | +GRaYamCCU97s8vdl3sV7vq50bkxo6TunC1K6ijTlC69vjdUD2aIrD8Jlii/4TXHa |
| 113 | +/QyhgeW7Fs5yBqqK9rQkX5LUvdXI81vuTtvcTL/2IW4Tnu51imiP3cTMmn1fjjMD |
| 114 | +uuuo2zShcNpZBNjodiv5FHZeEGgrdF0yZNVCTnW32jUQYhnntoEt7TzjVNKXJd+r |
| 115 | +XvS4GjR2TdqZ98FFUZNBNO57R1ZDbvqParKwOcsss+1db5UQ7s44BBVGw+qlnJoX |
| 116 | +GDE0YoCEcmeQvpvJbJ8WxFFk8uPGyN6UdTlhLu5Pof6kfFA+VTwtnM5l6TvE9uD3 |
| 117 | +CTtp4X/yhbRFbl764gFubcQj+L9s5urFNgKGmNaWt9kheGFRVTY8VOXHMrMwFwFu |
| 118 | +Kw63llKOsZyrrX5Zmuegve7WnIZsZzW56LaZN37HsQaq+QcLhmQ= |
| 119 | +=6O2f |
| 120 | +-----END PGP SIGNATURE----- |
| 121 | +``` |
0 commit comments