Node.js 26.3.1 Security Release

This release tightens several security checks, which changes behavior for code that relied on the old, unsafe handling.

• TLS hostname matching is now normalized and case-sensitive SNI matching is corrected, so previously-accepted mismatched hostnames or SNI contexts will now be rejected
• TLS session reuse is now bound to the authenticated host, so sessions reused across mismatched hosts will no longer work
• DNS and net calls now reject hostnames containing embedded NUL bytes, so such hostnames will fail where they previously succeeded
• HTTP/2 origin sets are capped in size, so connections that previously grew unbounded origin sets will be limited
• Proxy credentials are now redacted in tunnel error messages, so code or logs expecting the credentials to appear there will not see them
• The permission model now blocks process.chdir, FileHandle utimes, and pipe open/chmod operations in cases where it previously allowed them

Upgrade to Node.js 26.3.1 to receive these fixes; no code changes are required for most applications.

• Update to version 26.3.1
• Review any code relying on hostnames with embedded NUL bytes, proxy credentials appearing in tunnel errors, or permission-model operations now blocked, since those will need adjustment