25 October 2026 Node.js 20.11.1 is a security release that addresses multiple security issues, including code injection, privilege escalation, denial of service, and permission model bypasses.
Announced 14 Feb 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 20.11.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.11.1 Version 20.11.1 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-21892 CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities CVE-2024-22019 CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks CVE-2024-21896 CVE-2024-21896 - Path traversal by monkey-patching Buffer internals CVE-2024-22017 CVE-2024-22017 - setuid() does not drop all privileges due to io_uring CVE-2023-46809 CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack CVE-2024-21891 CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization CVE-2024-21890 CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write CVE-2024-22025 CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding Publisher severity No explicit severity was extracted.
Event #24814 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:41:22 GMT
Publisher date Wed, 14 Feb 2024 17:35:59 GMT Read the original announcement Node.js security releases address two vulnerabilities in the 18.x, 20.x, and 21.x release lines, including an HTTP/2 server crash and HTTP request smuggling. The release also updates llhttp and undici dependencies.
Announced 3 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues. Node.js The Node.js Project Affected versions 18.x The 18.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue. 20.x The 20.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue. 21.x The 21.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue. Fixed versions 18.x Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues. 20.x Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues. 21.x Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
Prerequisites Not stated in this extraction llhttp llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Affected versions Not stated in this extraction Fixed versions 9.2.1 llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Prerequisites Not stated in this extraction undici undici version 6.11.1 on 21.x
Affected versions Not stated in this extraction Fixed versions 6.11.1 undici version 6.11.1 on 21.x 5.28.4 undici version 5.28.4 on 18.x and 20.x
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27983 Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983) CVE-2024-27982 HTTP Request Smuggling via Content Length Obfuscation - (CVE-2024-27982) Publisher severity No explicit severity was extracted.
Event #24633 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:38:36 GMT
Publisher date Wed, 03 Apr 2024 03:00:00 GMT Read the original announcement Node.js 20.12.1 is a security release addressing HTTP/2 server crashes and HTTP request smuggling.
Announced 3 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release Node.js Node.js 20.12.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.12.1 Version 20.12.1 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27983 CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High) CVE-2024-27982 CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium) Publisher severity No explicit severity was extracted.
Event #24332 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:33:34 GMT
Publisher date Wed, 03 Apr 2024 14:16:00 GMT Read the original announcement Node.js 21.7.2 is a security release addressing HTTP/2 server crashes and HTTP request smuggling.
Announced 3 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 21.7.2 (Current)
Affected versions Not stated in this extraction Fixed versions 21.7.2 Version 21.7.2 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27983 CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High) CVE-2024-27982 CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation- (Medium) Publisher severity No explicit severity was extracted.
Event #24219 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:31:45 GMT
Publisher date Wed, 03 Apr 2024 14:18:52 GMT Read the original announcement Node.js 18.20.1 is a security release addressing an HTTP/2 server crash and HTTP request smuggling. The release identifies both issues as security fixes, but does not specify affected version ranges.
Announced 3 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 18.20.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.20.1 Version 18.20.1 'Hydrogen' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27983 CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High) CVE-2024-27982 CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium) Publisher severity No explicit severity was extracted.
Event #24195 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:31:26 GMT
Publisher date Wed, 03 Apr 2024 14:27:39 GMT Read the original announcement Node.js 18.20.2 fixes a command injection vulnerability involving child_process.spawn on Windows when the shell option is disabled.
Announced 10 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Node.js Node.js 18.20.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.20.2 Version 18.20.2 'Hydrogen' (LTS) Prerequisites without shell option enabled on Windows CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Related CVEs CVE-2024-27980 CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Publisher severity No explicit severity was extracted.
Event #24063 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:29:21 GMT
Publisher date Wed, 10 Apr 2024 16:36:35 GMT Read the original announcement This security release addresses command injection on Windows through the args parameter of child_process.spawn when the shell option is disabled.
Announced 10 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Node.js Node.js 20.12.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.12.2 Version 20.12.2 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27980 CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Publisher severity No explicit severity was extracted.
Event #23969 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:27:22 GMT
Publisher date Wed, 10 Apr 2024 16:38:15 GMT Read the original announcement Node.js 21.7.3 is a security release addressing command injection through the child_process.spawn args parameter on Windows when the shell option is disabled.
Announced 10 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Node.js Node.js 21.7.3 (Current)
Affected versions Not stated in this extraction Fixed versions 21.7.3 Version 21.7.3 (Current) Prerequisites without shell option enabled on Windows without shell option enabled on Windows Related CVEs CVE-2024-27980 CVE-2024-27980 - Command injection via args parameter of child_process.spawn Publisher severity No explicit severity was extracted.
Event #23968 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:27:19 GMT
Publisher date Wed, 10 Apr 2024 16:38:50 GMT Read the original announcement Node.js security updates address five vulnerabilities across the 22.x, 20.x, and 18.x release lines. Downloads listed are Node.js v18.20.4, v20.15.1, and v22.4.1.
Announced 8 Jul 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Security releases available Updates are now available for the 22.x, 20.x, 18.x Node.js release lines for the following issues. Node.js Node.js v18.20.4 Affected versions 22.x Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x 20.x Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x 18.x Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x Fixed versions Node.js v18.20.4 Node.js v18.20.4 Node.js v20.15.1 Node.js v20.15.1 Node.js v22.4.1 Node.js v22.4.1
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27980 Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138) CVE-2024-36138 Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138) CVE-2024-22020 Bypass network import restriction via data URL (CVE-2024-22020) CVE-2024-36137 fs.fchown/fchmod bypasses permission model (CVE-2024-36137) CVE-2024-22018 fs.lstat bypasses permission model (CVE-2024-22018) CVE-2024-37372 Permission model improperly processes UNC paths (CVE-2024-37372) Publisher severity No explicit severity was extracted.
Event #23139 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:13:27 GMT
Publisher date Mon, 08 Jul 2024 03:00:00 GMT Read the original announcement Node.js 18.20.4 is a security release that addresses two listed vulnerabilities.
Announced 8 Jul 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 18.20.4 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.20.4 Version 18.20.4 'Hydrogen' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-36138 CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 CVE-2024-22020 - Bypass network import restriction via data URL (Medium) Publisher severity No explicit severity was extracted.
Event #23032 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:11:22 GMT
Publisher date Mon, 08 Jul 2024 18:15:09 GMT Read the original announcement Node.js 22.4.1 is a security release addressing multiple vulnerabilities, including permission-model bypasses and a network-import restriction bypass.
Announced 9 Jul 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 22.4.1 (Current)
Affected versions Not stated in this extraction Fixed versions 22.4.1 Version 22.4.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-36138 CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 CVE-2024-22020 - Bypass network import restriction via data URL (Medium) CVE-2024-22018 CVE-2024-22018 - fs.lstat bypasses permission model (Low) CVE-2024-36137 CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) CVE-2024-37372 CVE-2024-37372 - Permission model improperly processes UNC paths (Low) Publisher severity No explicit severity was extracted.
Event #23031 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:11:22 GMT
Publisher date Tue, 09 Jul 2024 02:31:49 GMT Read the original announcement Node.js 20.15.1 is a security release addressing several vulnerabilities involving network import restrictions and the permission model.
Announced 8 Jul 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 20.15.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.15.1 Version 20.15.1 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-36138 CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 CVE-2024-22020 - Bypass network import restriction via data URL (Medium) CVE-2024-22018 CVE-2024-22018 - fs.lstat bypasses permission model (Low) CVE-2024-36137 CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) CVE-2024-37372 CVE-2024-37372 - Permission model improperly processes UNC paths (Low) Publisher severity No explicit severity was extracted.
Event #22944 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:10:22 GMT
Publisher date Mon, 08 Jul 2024 18:16:32 GMT Read the original announcement The Node.js Project plans to issue a CVE notifying users that end-of-life Node.js versions are unmaintained and may pose security risks. Users are encouraged to upgrade to a supported version.
Announced 6 Jan 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context We will soon issue a Common Vulnerabilities and Exposures (CVE) identifier for End-of-Life (EOL) versions of Node.js. Node.js End-of-Life (EOL) versions of Node.js Affected versions All other versions All other versions are no longer supported and should be considered deprecated.
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #21361 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 05:43:29 GMT
Publisher date Mon, 06 Jan 2025 16:00:00 GMT Read the original announcement Node.js 18.20.6 is a security release fixing HTTP/2 memory leakage and Windows path traversal issues, and updating undici to address insufficiently random values in fetch().
Announced 21 Jan 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 18.20.6 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.20.6 Version 18.20.6 'Hydrogen' (LTS)
Prerequisites Not stated in this extraction undici Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Affected versions Not stated in this extraction Fixed versions v5.28.5 deps: update undici to v5.28.5
Prerequisites Not stated in this extraction Related CVEs CVE-2025-23085 CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium) CVE-2025-23084 CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium) CVE-2025-22150 CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium) Publisher severity No explicit severity was extracted.
Event #21250 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 05:41:20 GMT
Publisher date Tue, 21 Jan 2025 17:05:27 GMT Read the original announcement Node.js 20.18.2 (LTS) addresses multiple security issues, including flaws involving InternalWorker use, HTTP/2, Windows path normalization, and undici fetch().
Announced 21 Jan 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 20.18.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.18.2 Version 20.18.2 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-23083 CVE-2025-23083 - throw on InternalWorker use when permission model is enabled (High) CVE-2025-23085 CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium) CVE-2025-23084 CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium) CVE-2025-22150 Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium) Publisher severity No explicit severity was extracted.
Event #21055 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 05:38:23 GMT
Publisher date Tue, 21 Jan 2025 17:05:40 GMT Read the original announcement Node.js 22.13.1 is a security release addressing multiple vulnerabilities, including issues involving the permission model, HTTP/2, Windows path normalization, and undici fetch().
Announced 21 Jan 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 22.13.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 22.13.1 Version 22.13.1 'Jod' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-23083 CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High) CVE-2025-23085 CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium) CVE-2025-23084 CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium) CVE-2025-22150 Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium) Publisher severity No explicit severity was extracted.
Event #20948 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 05:36:33 GMT
Publisher date Tue, 21 Jan 2025 17:05:48 GMT Read the original announcement Node.js 23.6.1 addresses security issues involving InternalWorker use with the permission model, HTTP/2 memory leakage, Windows path traversal, and insufficiently random values in undici fetch().
Announced 21 Jan 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 23.6.1 (Current)
Affected versions Not stated in this extraction Fixed versions 23.6.1 Version 23.6.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2025-23083 CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High) CVE-2025-23085 CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium) CVE-2025-23084 CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium) CVE-2025-22150 Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium) Publisher severity No explicit severity was extracted.
Event #20939 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 05:36:25 GMT
Publisher date Tue, 21 Jan 2025 17:06:07 GMT Read the original announcement The CVE Program rejected CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089, which had been issued to identify end-of-life Node.js versions. The Node.js project says it will instead update previous vulnerability-specific CVEs to include EOL releases unless it has information showing a CVE does not apply.
Announced 7 Mar 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to tag EOL versions have been rejected by the CVE Program. The Node.js team has, therefore, decided to update previous vulnerability specific CVEs to cover EOL releases Node.js Node.js released security patches for four active release lines
Affected versions Not stated in this extraction
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2025-23087 CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to tag EOL versions have been rejected by the CVE Program. CVE-2025-23088 CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to tag EOL versions have been rejected by the CVE Program. CVE-2025-23089 CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to tag EOL versions have been rejected by the CVE Program. Publisher severity No explicit severity was extracted.
Event #20505 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 05:29:22 GMT
Publisher date Fri, 07 Mar 2025 16:00:00 GMT Read the original announcement Node.js 18 and earlier are unsupported and do not receive security patches. The article advises upgrading to a supported Node.js version or obtaining commercial post-EOL support.
Announced 6 Jun 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js 18 and all earlier versions are End-Of-Life. They are now completely unsupported, meaning they receive no updates, including security patches. Node.js Node.js 18 and all earlier versions are End-Of-Life. Affected versions 18 and all earlier versions Node.js 18 and all earlier versions are End-Of-Life.
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2025-23167 https://nvd.nist.gov/vuln/detail/CVE-2025-23167 affects 18, 16, 14 (llhttp) - medium CVE-2023-5678 https://nvd.nist.gov/vuln/detail/CVE-2023-5678 affects 16, 14 (openssl) - medium CVE-2024-22019 https://nvd.nist.gov/vuln/detail/CVE-2024-22019 affects 16, 14 (llhttp) - high CVE-2021-39135 https://nvd.nist.gov/vuln/detail/CVE-2021-39135 affects 14 (npm) - high Publisher severity No explicit severity was extracted.
Event #19879 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 05:18:22 GMT
Publisher date Fri, 06 Jun 2025 12:00:00 GMT Read the original announcement Node.js security updates address three vulnerabilities affecting supported release lines. Updated releases include Node.js v20.19.2, v22.15.1, v23.11.1, and v24.0.2.
Announced 14 May 2025
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the 24.x, 23.x, 22.x, 20.x Node.js release lines for the following issues. Node.js Node.js v20.19.2 Affected versions 20.x This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x 22.x This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x 23.x This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x 24.x This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x Fixed versions Node.js v20.19.2 Node.js v20.19.2 Node.js v22.15.1 Node.js v22.15.1 Node.js v23.11.1 Node.js v23.11.1 Node.js v24.0.2 Node.js v24.0.2
Prerequisites Not stated in this extraction Node.js A flaw in Node.js 20's HTTP parser Affected versions Node.js 20.x users prior to the llhttp v9 upgrade This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade. Fixed versions llhttp to version 9 The issue was resolved by upgrading llhttp to version 9
Prerequisites Not stated in this extraction Node.js In Node.js, the ReadFileUtf8 internal binding Affected versions v20 and v22 This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22. Fixed versions Node.js v20.19.2 Node.js v20.19.2 Node.js v22.15.1 Node.js v22.15.1 Prerequisites Windows systems relying on the ReadFileUtf8 API This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22. Related CVEs CVE-2025-23166 Improper error handling in async cryptographic operations crashes process (CVE-2025-23166) CVE-2025-23167 Improper HTTP header block termination in llhttp (CVE-2025-23167) CVE-2025-23165 Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165) Publisher severity No explicit severity was extracted.
Event #19567 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 05:12:39 GMT
Publisher date Wed, 14 May 2025 03:00:00 GMT Read the original announcement 