25 October 2026 Node.js 16.20.1 fixes multiple listed vulnerabilities, including issues in policy handling, the Windows installer, HTTP headers, and cryptographic operations.
Announced 20 Jun 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 16.20.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.20.1 Node.js 16.20.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-30581 CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High) CVE-2023-30585 CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) CVE-2023-30588 CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) CVE-2023-30589 CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) CVE-2023-30590 CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) Publisher severity No explicit severity was extracted.
Event #27685 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:29:35 GMT
Publisher date Tue, 20 Jun 2023 19:27:28 GMT Read the original announcement Node.js 20.3.1 fixes multiple security vulnerabilities, including issues in the experimental policy and permission mechanisms, installer repair, and HTTP request handling.
Announced 20 Jun 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 20.3.1 (Current)
Affected versions Not stated in this extraction Fixed versions 20.3.1 Node.js 20.3.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-30581 CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High) CVE-2023-30584 CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High) CVE-2023-30587 CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High) CVE-2023-30582 CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium) CVE-2023-30583 CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium) CVE-2023-30585 CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) CVE-2023-30586 CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium) CVE-2023-30588 CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) CVE-2023-30589 CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) CVE-2023-30590 CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) Publisher severity No explicit severity was extracted.
Event #27670 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:29:23 GMT
Publisher date Tue, 20 Jun 2023 20:13:40 GMT Read the original announcement Node.js 18.16.1 fixes multiple security vulnerabilities, including issues involving policy bypass, installer repair, HTTP request smuggling, and certificate handling.
Announced 20 Jun 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 18.16.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.16.1 Node.js 18.16.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-30581 CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High) CVE-2023-30585 CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) CVE-2023-30588 CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) CVE-2023-30589 CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) CVE-2023-30590 CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) Publisher severity No explicit severity was extracted.
Event #27543 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:27:22 GMT
Publisher date Tue, 20 Jun 2023 20:33:42 GMT Read the original announcement Security updates address multiple vulnerabilities in Node.js 16.x, 18.x and 20.x, including issues involving experimental policy and permission mechanisms. Updates are available in Node.js v16.20.2, v18.17.1 and v20.5.1.
Announced 9 Aug 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues. Node.js Node.js v16.20.2 (LTS) Affected versions 16.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. 18.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. 20.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Fixed versions v16.20.2 Node.js v16.20.2 (LTS) v18.17.1 Node.js v18.17.1 (LTS) v20.5.1 Node.js v20.5.1 (Current) Prerequisites using the experimental policy mechanism This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. using the experimental permission model This vulnerability affects all users using the experimental permission model in Node.js 20. Related CVEs CVE-2023-32002 Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002) CVE-2023-32004 Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004) CVE-2023-32558 process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558) CVE-2023-32006 Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006) CVE-2023-32559 Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559) CVE-2023-32005 fs.statfs can retrieve stats from files restricted by the Permission Model (LOW)(CVE-2023-32005) CVE-2023-32003 fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003) Publisher severity No explicit severity was extracted.
Event #27448 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:25:43 GMT
Publisher date Wed, 09 Aug 2023 14:30:00 GMT Read the original announcement Node.js 16.20.2 fixes three policy-bypass vulnerabilities and includes OpenSSL security updates.
Announced 9 Aug 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2023-32002: Policies can be bypassed via Module._load Node.js Node.js 16.20.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.20.2 Node.js 16.20.2 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-32002 CVE-2023-32002: Policies can be bypassed via Module._load (High) CVE-2023-32006 CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium) CVE-2023-32559 CVE-2023-32559: Policies can be bypassed via process.binding (Medium) Publisher severity No explicit severity was extracted.
Event #27207 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:21:21 GMT
Publisher date Wed, 09 Aug 2023 16:51:54 GMT Read the original announcement Node.js 18.17.1 fixes three policy-bypass vulnerabilities and includes OpenSSL security updates.
Announced 9 Aug 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2023-32002: Policies can be bypassed via Module._load (High) Node.js Node.js 18.17.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.17.1 Node.js 18.17.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-32002 CVE-2023-32002: Policies can be bypassed via Module._load (High) CVE-2023-32006 CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium) CVE-2023-32559 CVE-2023-32559: Policies can be bypassed via process.binding (Medium) Publisher severity No explicit severity was extracted.
Event #27206 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:21:21 GMT
Publisher date Wed, 09 Aug 2023 17:09:37 GMT Read the original announcement Node.js 20.5.1 fixes multiple policy and permission-model bypass vulnerabilities, including issues rated High, Medium, and Low.
Announced 9 Aug 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 20.5.1 (Current)
Affected versions Not stated in this extraction Fixed versions 20.5.1 Node.js 20.5.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-32002 CVE-2023-32002: Policies can be bypassed via Module._load (High) CVE-2023-32558 CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High) CVE-2023-32004 CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High) CVE-2023-32006 CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium) CVE-2023-32559 CVE-2023-32559: Policies can be bypassed via process.binding (Medium) CVE-2023-32005 CVE-2023-32005: fs.statfs can bypass the permission model (Low) CVE-2023-32003 CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low) Publisher severity No explicit severity was extracted.
Event #27124 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:20:22 GMT
Publisher date Wed, 09 Aug 2023 17:55:32 GMT Read the original announcement Node.js 20.8.0 reworks memory management for vm APIs that use importModuleDynamically, addressing long-standing memory leaks and use-after-free issues.
Announced 29 Sept 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This rework addressed a series of long-standing memory leaks and use-after-free issues in the following APIs that support importModuleDynamically: Node.js Node.js 20.8.0 (Current)
Affected versions Not stated in this extraction Fixed versions 20.8.0 Node.js 20.8.0 (Current) Prerequisites importModuleDynamically APIs that support importModuleDynamically Publisher severity No explicit severity was extracted.
Event #26665 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:12:36 GMT
Publisher date Fri, 29 Sep 2023 03:26:00 GMT Read the original announcement Security updates are available for Node.js 18.x and 20.x, addressing vulnerabilities in undici, nghttp2, and Node.js features. Downloads include Node.js v18.18.2 and v20.8.1.
Announced 13 Oct 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v18.x and v20.x Node.js release lines for the following issues. Node.js Node.js v20.8.1 (Current) Affected versions 18.x This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x. 20.x This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x. Fixed versions v20.8.1 Node.js v20.8.1 (Current) v18.18.2 Node.js v18.18.2 (LTS) Prerequisites experimental permission model This vulnerability affects all users using the experimental permission model in Node.js 20.x. experimental policy mechanism This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. --experimental-wasm-modules command line option This vulnerability affects users of the --experimental-wasm-modules command line option in all active release lines 18.x and 20.x. Related CVEs CVE-2023-45143 undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143) CVE-2023-44487 nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487) CVE-2023-39331 Permission model improperly protects against path traversal (High) - (CVE-2023-39331) CVE-2023-39332 Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332) CVE-2023-38552 Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552) CVE-2023-39333 Code injection via WebAssembly export names (Low) - (CVE-2023-39333) Publisher severity high
2 high severity issues.
Event #26545 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:10:24 GMT
Publisher date Fri, 13 Oct 2023 13:30:00 GMT Read the original announcement Node.js 20.8.1 fixes multiple security vulnerabilities, including issues involving nghttp2, undici, path traversal, policy integrity checks, and WebAssembly export names.
Announced 13 Oct 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 20.8.1 (Current)
Affected versions Not stated in this extraction Fixed versions 20.8.1 Node.js 20.8.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-44487 CVE-2023-44487: nghttp2 Security Release (High) CVE-2023-45143 CVE-2023-45143: undici Security Release (High) CVE-2023-39332 CVE-2023-39332: Path traversal through path stored in Uint8Array (High) CVE-2023-39331 CVE-2023-39331: Permission model improperly protects against path traversal (High) CVE-2023-38552 CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium) CVE-2023-39333 CVE-2023-39333: Code injection via WebAssembly export names (Low) Publisher severity No explicit severity was extracted.
Event #26544 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:10:19 GMT
Publisher date Fri, 13 Oct 2023 21:08:42 GMT Read the original announcement Node.js 18.18.2 fixes four listed security vulnerabilities.
Announced 13 Oct 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 18.18.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.18.2 Node.js 18.18.2 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-44487 CVE-2023-44487: nghttp2 Security Release (High) CVE-2023-45143 CVE-2023-45143: undici Security Release (High) CVE-2023-38552 CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium) CVE-2023-39333 CVE-2023-39333: Code injection via WebAssembly export names (Low) Publisher severity No explicit severity was extracted.
Event #26363 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:07:18 GMT
Publisher date Fri, 13 Oct 2023 21:09:24 GMT Read the original announcement Node.js 21.0.0 includes stricter HTTP parsing defaults that the announcement says enhance security, including mandatory CRLF after headers and chunks and rejecting data after a message with the Connection: close header. The --insecure-http-parser flag can disable these changes.
Announced 17 Oct 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context With the latest update, all settings that were previously included in strict mode are enabled by default, enhancing code reliability and security. Node.js Node.js 21 is now available!
Affected versions Not stated in this extraction Fixed versions Node.js 21.0.0 To download Node.js 21.0.0, visit:
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #26182 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:04:37 GMT
Publisher date Tue, 17 Oct 2023 15:45:00 GMT Read the original announcement Node.js 18.19.1 is a security release addressing several vulnerabilities, including code injection and privilege escalation, denial of service, and a timing attack. The release explicitly rates some issues High and others Medium.
Announced 14 Feb 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 18.19.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.19.1 Version 18.19.1 'Hydrogen' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-21892 CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) CVE-2024-22019 CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) CVE-2023-46809 CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) CVE-2024-22025 CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) Publisher severity No explicit severity was extracted.
Event #24996 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:44:21 GMT
Publisher date Wed, 14 Feb 2024 17:35:50 GMT Read the original announcement Node.js 21.6.2 is a security release addressing multiple vulnerabilities, including code injection, denial of service, path traversal, privilege escalation, and permission model bypasses.
Announced 14 Feb 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 21.6.2 (Current)
Affected versions Not stated in this extraction Fixed versions 21.6.2 Version 21.6.2 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-21892 CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) CVE-2024-22019 CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) CVE-2024-21896 CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High) CVE-2024-22017 CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High) CVE-2023-46809 CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) CVE-2024-21891 CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium) CVE-2024-21890 CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium) CVE-2024-22025 CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) Publisher severity No explicit severity was extracted.
Event #24995 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:44:20 GMT
Publisher date Wed, 14 Feb 2024 17:36:06 GMT Read the original announcement Node.js 20.11.1 is a security release that addresses multiple security issues, including code injection, privilege escalation, denial of service, and permission model bypasses.
Announced 14 Feb 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 20.11.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.11.1 Version 20.11.1 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-21892 CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities CVE-2024-22019 CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks CVE-2024-21896 CVE-2024-21896 - Path traversal by monkey-patching Buffer internals CVE-2024-22017 CVE-2024-22017 - setuid() does not drop all privileges due to io_uring CVE-2023-46809 CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack CVE-2024-21891 CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization CVE-2024-21890 CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write CVE-2024-22025 CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding Publisher severity No explicit severity was extracted.
Event #24814 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:41:22 GMT
Publisher date Wed, 14 Feb 2024 17:35:59 GMT Read the original announcement Node.js security releases address two vulnerabilities in the 18.x, 20.x, and 21.x release lines, including an HTTP/2 server crash and HTTP request smuggling. The release also updates llhttp and undici dependencies.
Announced 3 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues. Node.js The Node.js Project Affected versions 18.x The 18.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue. 20.x The 20.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue. 21.x The 21.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue. Fixed versions 18.x Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues. 20.x Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues. 21.x Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
Prerequisites Not stated in this extraction llhttp llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Affected versions Not stated in this extraction Fixed versions 9.2.1 llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Prerequisites Not stated in this extraction undici undici version 6.11.1 on 21.x
Affected versions Not stated in this extraction Fixed versions 6.11.1 undici version 6.11.1 on 21.x 5.28.4 undici version 5.28.4 on 18.x and 20.x
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27983 Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983) CVE-2024-27982 HTTP Request Smuggling via Content Length Obfuscation - (CVE-2024-27982) Publisher severity No explicit severity was extracted.
Event #24633 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:38:36 GMT
Publisher date Wed, 03 Apr 2024 03:00:00 GMT Read the original announcement Node.js 20.12.1 is a security release addressing HTTP/2 server crashes and HTTP request smuggling.
Announced 3 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release Node.js Node.js 20.12.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 20.12.1 Version 20.12.1 'Iron' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27983 CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High) CVE-2024-27982 CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium) Publisher severity No explicit severity was extracted.
Event #24332 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:33:34 GMT
Publisher date Wed, 03 Apr 2024 14:16:00 GMT Read the original announcement Node.js 21.7.2 is a security release addressing HTTP/2 server crashes and HTTP request smuggling.
Announced 3 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 21.7.2 (Current)
Affected versions Not stated in this extraction Fixed versions 21.7.2 Version 21.7.2 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27983 CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High) CVE-2024-27982 CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation- (Medium) Publisher severity No explicit severity was extracted.
Event #24219 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:31:45 GMT
Publisher date Wed, 03 Apr 2024 14:18:52 GMT Read the original announcement Node.js 18.20.1 is a security release addressing an HTTP/2 server crash and HTTP request smuggling. The release identifies both issues as security fixes, but does not specify affected version ranges.
Announced 3 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 18.20.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.20.1 Version 18.20.1 'Hydrogen' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-27983 CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High) CVE-2024-27982 CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium) Publisher severity No explicit severity was extracted.
Event #24195 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:31:26 GMT
Publisher date Wed, 03 Apr 2024 14:27:39 GMT Read the original announcement Node.js 18.20.2 fixes a command injection vulnerability involving child_process.spawn on Windows when the shell option is disabled.
Announced 10 Apr 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Node.js Node.js 18.20.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.20.2 Version 18.20.2 'Hydrogen' (LTS) Prerequisites without shell option enabled on Windows CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Related CVEs CVE-2024-27980 CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Publisher severity No explicit severity was extracted.
Event #24063 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:29:21 GMT
Publisher date Wed, 10 Apr 2024 16:36:35 GMT Read the original announcement 