Node.js 24.17.0 Security Release

This release changes behavior in several networking and security-sensitive subsystems to close the fixed vulnerabilities.

• TLS server identity checks now normalize hostnames and match SNI contexts case-insensitively, which can change which certificate/context is selected for a given hostname
• TLS session reuse is now bound to the authenticated host, so previously reused sessions across hosts will no longer be reused
• DNS/net now reject hostnames containing embedded NUL bytes, so lookups that previously succeeded with such hostnames will now fail
• HTTP/2 now caps the origin set size, so connections that previously grew an unbounded origin set will be limited
• WebCrypto cipher output length is now guarded, which can affect code relying on the previous unguarded behavior
• The permission model now blocks process.chdir in writereport contexts and disables FileHandle utimes, so code depending on those previously-allowed operations under the permission model will fail

Upgrade to Node.js 24.17.0 to receive these fixes.

• Update to 24.17.0 on the 24.x LTS line
• Review any code relying on cross-host TLS session reuse, NUL-byte hostnames, unbounded HTTP/2 origin sets, or the permission-model behaviors listed above
• Re-test applications using the permission model with chdir, writereport, or FileHandle utimes