25 October 2026 Node.js 24.4.1 is a security release addressing HashDoS in V8 and a Windows reserved-device-name path traversal protection bypass.
Announced 15 Jul 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 24.4.1 (Current)
Affected versions Not stated in this extraction Fixed versions 24.4.1 Node.js 24.4.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-27209 (CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm CVE-2025-27210 (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize() Publisher severity No explicit severity was extracted.
Event #19354 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:51:21 GMT
Publisher date Tue, 15 Jul 2025 22:14:44 GMT Read the original announcement Node.js 22.17.1 is a security release addressing a Windows device-name bypass of path traversal protection in path.normalize().
Announced 15 Jul 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Notable Changes (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize() Node.js Node.js 22.17.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 22.17.1 Version 22.17.1 'Jod' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-27210 (CVE-2025-27210) Publisher severity No explicit severity was extracted.
Event #19353 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:49:21 GMT
Publisher date Tue, 15 Jul 2025 22:14:56 GMT Read the original announcement Node.js 20.19.4 is a security release addressing a path traversal protection bypass involving Windows device names in path.normalize().
Announced 15 Jul 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Notable Changes (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize() Node.js Node.js 20.19.4 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.19.4 Node.js 20.19.4 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-27210 (CVE-2025-27210) Windows Device Names Publisher severity No explicit severity was extracted.
Event #19352 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:47:21 GMT
Publisher date Tue, 15 Jul 2025 22:15:06 GMT Read the original announcement Node.js released a mitigation for stack exhaustion that could cause immediate process termination when async_hooks is enabled. Upgrade to the patched Node.js versions; applications should also limit attacker-controlled recursion depth.
Announced 13 Jan 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js shipped a mitigation in the January 2026 security release Node.js Node.js 20.20.0 (LTS) Affected versions All Node.js versions from 8.x to 18.x All Node.js versions from 8.x to 18.x (8.x was the first version with async_hooks) Fixed versions Node.js 20.20.0 (LTS) Node.js 20.20.0 (LTS) Node.js 22.22.0 (LTS) Node.js 22.22.0 (LTS) Node.js 24.13.0 (LTS) Node.js 24.13.0 (LTS) Node.js 25.3.0 (Current) Node.js 25.3.0 (Current) Prerequisites when async_hooks are enabled An edge case that reproduces only when async_hooks are enabled Related CVEs CVE-2025-15284 like the recent qs vulnerability CVE-2025-15284 showed Publisher severity No explicit severity was extracted.
Event #19351 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:25:22 GMT
Publisher date Tue, 13 Jan 2026 17:00:00 GMT Read the original announcement Node.js 20.20.0 (LTS) is a security release that includes fixes associated with six CVEs.
Announced 13 Jan 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 20.20.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.20.0 Version 20.20.0 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-55132 (CVE-2025-55132) disable futimes when permission model is enabled CVE-2025-59465 (CVE-2025-59465) add TLSSocket default error handler CVE-2025-55130 (CVE-2025-55130) require full read and write to symlink APIs CVE-2025-59466 (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks CVE-2025-55131 (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle CVE-2026-21637 (CVE-2026-21637) route callback exceptions through error handlers Publisher severity No explicit severity was extracted.
Event #19350 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:22:23 GMT
Publisher date Tue, 13 Jan 2026 13:56:13 GMT Read the original announcement Node.js released security updates for active 20.x, 22.x, 24.x, and 25.x lines, addressing multiple vulnerabilities. The announcement lists updated release versions and reports high, medium, and low severity issues.
Announced 13 Jan 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address: 3 high severity issues. 4 medium severity issues. 1 low severity issue. Node.js Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines Affected versions 20.x This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x 22.x This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x 24.x This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x 25.x This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x Fixed versions Node.js 20.20.0 Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0 Node.js 22.22.0 Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0 Node.js 24.13.0 Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0 Node.js 25.3.0 Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0
Prerequisites Not stated in this extraction Related CVEs CVE-2025-55131 Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131) CVE-2025-55130 Bypass File System Permissions using crafted symlinks (CVE-2025-55130) CVE-2025-59465 Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465) CVE-2025-59466 Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466) CVE-2025-59464 Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464) CVE-2026-21636 Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636) CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637) CVE-2025-55132 fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132) Publisher severity No explicit severity was extracted.
Event #19349 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:21:25 GMT
Publisher date Tue, 13 Jan 2026 00:00:00 GMT Read the original announcement Node.js 24.13.0 is identified as a security release and includes fixes associated with six CVEs.
Announced 13 Jan 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 24.13.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 24.13.0 Version 24.13.0 'Krypton' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-59465 (CVE-2025-59465) add TLSSocket default error handler CVE-2025-55132 (CVE-2025-55132) disable futimes when permission model is enabled CVE-2025-55130 (CVE-2025-55130) require full read and write to symlink APIs CVE-2025-59466 (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks CVE-2025-55131 (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle CVE-2026-21637 (CVE-2026-21637) route callback exceptions through error handlers Publisher severity No explicit severity was extracted.
Event #19348 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:19:22 GMT
Publisher date Tue, 13 Jan 2026 13:58:10 GMT Read the original announcement Node.js 25.3.0 is a security release containing fixes for multiple CVEs.
Announced 13 Jan 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 25.3.0 (Current)
Affected versions Not stated in this extraction Fixed versions 25.3.0 Node.js 25.3.0 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-59465 (CVE-2025-59465) add TLSSocket default error handler CVE-2026-21636 (CVE-2026-21636) add network check on pipe_wrap connect CVE-2025-55130 (CVE-2025-55130) require full read and write to symlink APIs CVE-2025-55132 (CVE-2025-55132) disable futimes when permission model is enabled CVE-2025-59466 (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks CVE-2025-55131 (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle CVE-2026-21637 (CVE-2026-21637) route callback exceptions through error handlers Publisher severity No explicit severity was extracted.
Event #19347 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:18:23 GMT
Publisher date Tue, 13 Jan 2026 13:58:49 GMT Read the original announcement Node.js 24.13.1 includes fixes for CVE-2025-59465 and CVE-2026-21637.
Announced 10 Feb 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context [32b03d0604] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) Node.js Node.js 24.13.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 24.13.1 Node.js 24.13.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-59465 (CVE-2025-59465) lib: add TLSSocket default error handler CVE-2026-21637 (CVE-2026-21637) tls: route callback exceptions through error handlers Publisher severity No explicit severity was extracted.
Event #19346 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:16:21 GMT
Publisher date Tue, 10 Feb 2026 13:37:37 GMT Read the original announcement Node.js 22.22.0 is a security release that includes fixes for multiple listed CVEs.
Announced 13 Jan 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 22.22.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 22.22.0 Version 22.22.0 'Jod' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-59465 (CVE-2025-59465) add TLSSocket default error handler CVE-2025-55132 (CVE-2025-55132) disable futimes when permission model is enabled CVE-2025-55130 (CVE-2025-55130) require full read and write to symlink APIs CVE-2025-59466 (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks CVE-2025-55131 (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle CVE-2026-21637 (CVE-2026-21637) route callback exceptions through error handlers Publisher severity No explicit severity was extracted.
Event #19345 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:15:22 GMT
Publisher date Tue, 13 Jan 2026 14:18:09 GMT Read the original announcement The Node.js Project reports that three OpenSSL vulnerabilities affect Node.js branches through PFX certificate processing. The issues require a specially crafted PFX file; updates are planned for upcoming regular Node.js releases.
Announced 28 Jan 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The OpenSSL project released a security advisory that includes 12 CVEs. After assessment, we have concluded that three CVEs affect Node.js (severity Low to Moderate). Node.js three CVEs affect Node.js
Fixed versions Not stated in this extraction Prerequisites An attacker would need to provide a specially crafted PFX file An attacker would need to provide a specially crafted PFX file to trigger any of these issues. Related CVEs CVE-2025-11187 CVE-2025-11187: Stack buffer overflow in PBMAC1 MAC verification - Moderate CVE-2025-69421 CVE-2025-69421: NULL pointer dereference in PKCS12_item_decrypt_d2i_ex() - Low CVE-2026-22795 CVE-2026-22795: Type confusion during PKCS#12 parsing - Low Publisher severity No explicit severity was extracted.
Event #19344 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:09:23 GMT
Publisher date Wed, 28 Jan 2026 17:00:00 GMT Read the original announcement The Node.js Project requires a HackerOne Signal of 1.0 or higher to submit vulnerability reports through HackerOne. Researchers below that threshold can contact the security team through the OpenJS Foundation Slack.
Announced 19 Feb 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context We have updated our HackerOne program to require a Signal of 1.0 or higher to submit vulnerability reports to the Node.js project. Node.js submit vulnerability reports to the Node.js project
Affected versions Not stated in this extraction
Fixed versions Not stated in this extraction Prerequisites Signal of 1.0 or higher require a Signal of 1.0 or higher to submit vulnerability reports to the Node.js project Publisher severity No explicit severity was extracted.
Event #19343 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 04:06:22 GMT
Publisher date Thu, 19 Feb 2026 12:00:00 GMT Read the original announcement Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.
Announced 24 Mar 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues. Node.js Node.js v20.20.2 Affected versions 20.x The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues. 22.x The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues. 24.x The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues. 25.x The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues. Fixed versions Node.js v20.20.2 Node.js v20.20.2 Node.js v22.22.2 Node.js v22.22.2 Node.js v24.14.1 Node.js v24.14.1 Node.js v25.8.2 Node.js v25.8.2
Prerequisites Not stated in this extraction Related CVEs CVE-2026-21637 Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637) CVE-2026-21710 Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710) CVE-2026-21711 Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711) CVE-2026-21712 Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712) CVE-2026-21713 Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713) CVE-2026-21714 Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714) CVE-2026-21717 HashDoS in V8 (CVE-2026-21717) CVE-2026-21715 Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715) CVE-2026-21716 CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716) Publisher severity high
2 high severity issues.
Event #19342 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 03:57:28 GMT
Publisher date Tue, 24 Mar 2026 03:00:00 GMT Read the original announcement Node.js 22.22.2 is a security release addressing multiple vulnerabilities, with fixes listed as High, Medium, and Low.
Announced 24 Mar 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 22.22.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 22.22.2 Version 22.22.2 'Jod' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2026-21637 (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High CVE-2026-21710 (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High CVE-2026-21713 (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium CVE-2026-21714 (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium CVE-2026-21717 (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium CVE-2026-21715 (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low CVE-2026-21716 (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low Publisher severity No explicit severity was extracted.
Event #19341 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 03:56:22 GMT
Publisher date Tue, 24 Mar 2026 20:43:26 GMT Read the original announcement Node.js 24.14.1 is a security release that addresses multiple security issues.
Announced 24 Mar 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 24.14.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 24.14.1 Node.js 24.14.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2026-21710 (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct CVE-2026-21637 (CVE-2026-21637) wrap SNICallback invocation in try/catch CVE-2026-21717 (CVE-2026-21717) test array index hash collision CVE-2026-21713 (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC CVE-2026-21714 (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code CVE-2026-21712 (CVE-2026-21712) handle url crash on different url formats CVE-2026-21716 (CVE-2026-21716) include permission check on lib/fs/promises CVE-2026-21715 (CVE-2026-21715) add permission check to realpath.native Publisher severity No explicit severity was extracted.
Event #19340 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 03:55:22 GMT
Publisher date Tue, 24 Mar 2026 20:43:31 GMT Read the original announcement Node.js 20.20.2 is a security release fixing multiple issues, including array index hash collision, timing-safe comparison, permission checks, and TLS callback handling.
Announced 24 Mar 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 20.20.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.20.2 Version 20.20.2 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2026-21717 (CVE-2026-21717) fix array index hash collision CVE-2026-21713 (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC CVE-2026-21710 (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct CVE-2026-21716 (CVE-2026-21716) include permission check on lib/fs/promises CVE-2026-21715 (CVE-2026-21715) add permission check to realpath.native CVE-2026-21714 (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code CVE-2026-21637 (CVE-2026-21637) wrap SNICallback invocation in try/catch Publisher severity No explicit severity was extracted.
Event #19339 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 03:54:22 GMT
Publisher date Tue, 24 Mar 2026 20:35:47 GMT Read the original announcement Node.js 25.8.2 is a security release addressing multiple CVEs.
Announced 24 Mar 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 25.8.2 (Current)
Affected versions Not stated in this extraction Fixed versions 25.8.2 Version 25.8.2 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2026-21637 (CVE-2026-21637) CVE-2026-21710 (CVE-2026-21710) CVE-2026-21711 (CVE-2026-21711) CVE-2026-21712 (CVE-2026-21712) CVE-2026-21713 (CVE-2026-21713) CVE-2026-21714 (CVE-2026-21714) CVE-2026-21715 (CVE-2026-21715) CVE-2026-21716 (CVE-2026-21716) CVE-2026-21717 (CVE-2026-21717) Publisher severity No explicit severity was extracted.
Event #19338 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 03:52:21 GMT
Publisher date Tue, 24 Mar 2026 20:43:41 GMT Read the original announcement The Node.js Project has paused monetary bounty payouts because its external funding source was discontinued. Security reports are still accepted and triaged through HackerOne.
Announced 2 Apr 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The Node.js project's security bug bounty program is being paused due to the discontinuation of its external funding source. Node.js the Node.js project
Affected versions Not stated in this extraction
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #19337 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 03:50:21 GMT
Publisher date Thu, 02 Apr 2026 12:00:00 GMT Read the original announcement Node.js enabled a seeded hash for array index strings to mitigate HashDoS vulnerability CVE-2026-21717. The fix shipped in the March 2026 security release for the listed Node.js versions.
Announced 24 Mar 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release. Node.js In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release.
Affected versions Not stated in this extraction Fixed versions v25 In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release. v24 In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release. v22 In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release. v20 In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release.
Prerequisites Not stated in this extraction Related CVEs CVE-2026-21717 That's the puzzle we tried to solve for addressing CVE-2026-21717 in the March 2026 Node.js security release. Publisher severity No explicit severity was extracted.
Event #19336 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 03:49:23 GMT
Publisher date Tue, 24 Mar 2026 20:50:00 GMT Read the original announcement Node.js 22.22.3 includes a fix for a potential null pointer dereference when BIO_meth_new() fails.
Announced 13 May 2026
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context crypto: fix potential null pointer dereference when BIO_meth_new() fails Node.js Node.js 22.22.3 (LTS)
Affected versions Not stated in this extraction Fixed versions 22.22.3 Version 22.22.3 'Jod' (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #19335 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 03:43:21 GMT
Publisher date Wed, 13 May 2026 18:45:03 GMT Read the original announcement 