Node.js — Node.js 22.22.2 (LTS)

Node.js 22.22.2 (LTS) is a security release for the 'Jod' LTS line, addressing 7 CVEs. Two high-severity fixes include wrapping SNICallback in try/catch (CVE-2026-21637) and using null prototype for headersDistinct/trailersDistinct to prevent prototype pollution (CVE-2026-21710). Medium-severity fixes cover timing-safe HMAC comparison in Web Cryptography (CVE-2026-21713), HTTP/2 flow control error handling (CVE-2026-21714), and a V8 array index hash collision (CVE-2026-21717). Two low-severity permission model fixes add checks to realpath.native and fs/promises. Dependencies updated include npm 10.9.7 and undici v6.24.1.