25 October 2026 Node.js 14.21.3 fixes security vulnerabilities, includes OpenSSL security updates, and updates npm.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js 14 This security release also includes an npm update for Node.js 14
Affected versions Not stated in this extraction Fixed versions 14.21.3 Node.js 14.21.3 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-23918 CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920 CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) Publisher severity No explicit severity was extracted.
Event #28975 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:51:21 GMT
Publisher date Thu, 16 Feb 2023 22:08:13 GMT Read the original announcement Node.js 16.19.1 (LTS) fixes several security vulnerabilities, including issues in permissions policies, crypto, ICU data loading, and the Fetch API.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 16.19.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.19.1 Node.js 16.19.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-23918 CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23919 CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium) CVE-2023-23920 CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) CVE-2023-23936 CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) CVE-2023-24807 CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low) Publisher severity No explicit severity was extracted.
Event #28880 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:49:37 GMT
Publisher date Thu, 16 Feb 2023 22:16:31 GMT Read the original announcement Node.js 19.6.1 fixes multiple security vulnerabilities, including three CVEs, and includes OpenSSL security updates.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2023-23919: OpenSSL errors not cleared in error stack (Medium) CVE-2023-23918: Experimental Policies bypass via process.mainModule.require(High) CVE-2023-23920: Insecure loading of ICU data through ICU_DATA environment variable (Low) Node.js Node.js 19.6.1 (Current)
Affected versions Not stated in this extraction Fixed versions 19.6.1 Node.js 19.6.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-23919 CVE-2023-23919: OpenSSL errors not cleared in error stack (Medium) CVE-2023-23918 CVE-2023-23918: Experimental Policies bypass via process.mainModule.require(High) CVE-2023-23920 CVE-2023-23920: Insecure loading of ICU data through ICU_DATA environment variable (Low) Publisher severity No explicit severity was extracted.
Event #28862 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:49:22 GMT
Publisher date Thu, 16 Feb 2023 22:21:38 GMT Read the original announcement Node.js 18.14.1 fixes five listed CVEs and includes OpenSSL security updates.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 18.14.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.14.1 Node.js 18.14.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-23918 CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23919 CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium) CVE-2023-23936 CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) CVE-2023-24807 CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low) CVE-2023-23920 CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) Publisher severity No explicit severity was extracted.
Event #28760 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:47:41 GMT
Publisher date Thu, 16 Feb 2023 22:22:52 GMT Read the original announcement Node.js 20.0.0 includes fixes described as addressing vulnerabilities in its experimental Permission Model.
Announced 18 Apr 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context permission: fix some vulnerabilities in fs (Tobias Nießen) #47091 Node.js Node.js 20.0.0 (Current)
Affected versions Not stated in this extraction Fixed versions 20.0.0 Node.js 20.0.0 (Current)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #28197 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:38:21 GMT
Publisher date Tue, 18 Apr 2023 16:07:46 GMT Read the original announcement Security updates address vulnerabilities in Node.js and bundled OpenSSL and c-ares components. Updated releases are Node.js v16.20.1, v18.16.1, and v20.3.1.
Announced 20 Jun 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for all supported Node.js release lines for the following issues. Node.js Node.js v16.20.1 (LTS) Affected versions 16.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. 18.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. 20.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Fixed versions Node.js v16.20.1 Node.js v16.20.1 (LTS) Node.js v18.16.1 Node.js v18.16.1 (LTS) Node.js v20.3.1 Node.js v20.3.1 (Current) Prerequisites using the experimental policy mechanism This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. using the experimental permission model This vulnerability affects all users using the experimental permission model in Node.js 20. Related CVEs CVE-2023-30581 mainModule.proto bypass experimental policy mechanism (High) (CVE-2023-30581) CVE-2023-30584 Path traversal bypass in experimental permission model (High) (CVE-2023-30584) CVE-2023-30587 Inspector protocol bypass the experimental permission model (High) (CVE-2023-30587) CVE-2023-30582 fs.watchFile bypass in experimental permission model (Medium) (CVE-2023-30582) CVE-2023-30583 fs.openAsBlob bypass in experimental permission model (Medium) (CVE-2023-30583) CVE-2023-30585 Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) (CVE-2023-30585) CVE-2023-30586 OpenSSL engines can be used to bypass the permission model (Medium) (CVE-2023-30586) CVE-2023-30588 Process interruption due to invalid Public Key information in x509 certificates (Medium) (CVE-2023-30588) CVE-2023-30589 HTTP Request Smuggling via Empty headers separated by CR (Medium) (CVE-2023-30589) CVE-2023-30590 DiffieHellman do not generate keys after setting a private key (Medium) (CVE-2023-30590) Publisher severity No explicit severity was extracted.
Event #28023 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:35:25 GMT
Publisher date Tue, 20 Jun 2023 14:30:00 GMT Read the original announcement Node.js 16.20.1 fixes multiple listed vulnerabilities, including issues in policy handling, the Windows installer, HTTP headers, and cryptographic operations.
Announced 20 Jun 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 16.20.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.20.1 Node.js 16.20.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-30581 CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High) CVE-2023-30585 CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) CVE-2023-30588 CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) CVE-2023-30589 CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) CVE-2023-30590 CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) Publisher severity No explicit severity was extracted.
Event #27685 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:29:35 GMT
Publisher date Tue, 20 Jun 2023 19:27:28 GMT Read the original announcement Node.js 20.3.1 fixes multiple security vulnerabilities, including issues in the experimental policy and permission mechanisms, installer repair, and HTTP request handling.
Announced 20 Jun 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 20.3.1 (Current)
Affected versions Not stated in this extraction Fixed versions 20.3.1 Node.js 20.3.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-30581 CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High) CVE-2023-30584 CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High) CVE-2023-30587 CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High) CVE-2023-30582 CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium) CVE-2023-30583 CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium) CVE-2023-30585 CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) CVE-2023-30586 CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium) CVE-2023-30588 CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) CVE-2023-30589 CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) CVE-2023-30590 CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) Publisher severity No explicit severity was extracted.
Event #27670 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:29:23 GMT
Publisher date Tue, 20 Jun 2023 20:13:40 GMT Read the original announcement Node.js 18.16.1 fixes multiple security vulnerabilities, including issues involving policy bypass, installer repair, HTTP request smuggling, and certificate handling.
Announced 20 Jun 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 18.16.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.16.1 Node.js 18.16.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-30581 CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High) CVE-2023-30585 CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) CVE-2023-30588 CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) CVE-2023-30589 CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) CVE-2023-30590 CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) Publisher severity No explicit severity was extracted.
Event #27543 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:27:22 GMT
Publisher date Tue, 20 Jun 2023 20:33:42 GMT Read the original announcement Security updates address multiple vulnerabilities in Node.js 16.x, 18.x and 20.x, including issues involving experimental policy and permission mechanisms. Updates are available in Node.js v16.20.2, v18.17.1 and v20.5.1.
Announced 9 Aug 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues. Node.js Node.js v16.20.2 (LTS) Affected versions 16.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. 18.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. 20.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Fixed versions v16.20.2 Node.js v16.20.2 (LTS) v18.17.1 Node.js v18.17.1 (LTS) v20.5.1 Node.js v20.5.1 (Current) Prerequisites using the experimental policy mechanism This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. using the experimental permission model This vulnerability affects all users using the experimental permission model in Node.js 20. Related CVEs CVE-2023-32002 Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002) CVE-2023-32004 Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004) CVE-2023-32558 process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558) CVE-2023-32006 Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006) CVE-2023-32559 Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559) CVE-2023-32005 fs.statfs can retrieve stats from files restricted by the Permission Model (LOW)(CVE-2023-32005) CVE-2023-32003 fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003) Publisher severity No explicit severity was extracted.
Event #27448 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:25:43 GMT
Publisher date Wed, 09 Aug 2023 14:30:00 GMT Read the original announcement Node.js 16.20.2 fixes three policy-bypass vulnerabilities and includes OpenSSL security updates.
Announced 9 Aug 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2023-32002: Policies can be bypassed via Module._load Node.js Node.js 16.20.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.20.2 Node.js 16.20.2 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-32002 CVE-2023-32002: Policies can be bypassed via Module._load (High) CVE-2023-32006 CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium) CVE-2023-32559 CVE-2023-32559: Policies can be bypassed via process.binding (Medium) Publisher severity No explicit severity was extracted.
Event #27207 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:21:21 GMT
Publisher date Wed, 09 Aug 2023 16:51:54 GMT Read the original announcement Node.js 18.17.1 fixes three policy-bypass vulnerabilities and includes OpenSSL security updates.
Announced 9 Aug 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2023-32002: Policies can be bypassed via Module._load (High) Node.js Node.js 18.17.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.17.1 Node.js 18.17.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-32002 CVE-2023-32002: Policies can be bypassed via Module._load (High) CVE-2023-32006 CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium) CVE-2023-32559 CVE-2023-32559: Policies can be bypassed via process.binding (Medium) Publisher severity No explicit severity was extracted.
Event #27206 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:21:21 GMT
Publisher date Wed, 09 Aug 2023 17:09:37 GMT Read the original announcement Node.js 20.5.1 fixes multiple policy and permission-model bypass vulnerabilities, including issues rated High, Medium, and Low.
Announced 9 Aug 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 20.5.1 (Current)
Affected versions Not stated in this extraction Fixed versions 20.5.1 Node.js 20.5.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-32002 CVE-2023-32002: Policies can be bypassed via Module._load (High) CVE-2023-32558 CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High) CVE-2023-32004 CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High) CVE-2023-32006 CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium) CVE-2023-32559 CVE-2023-32559: Policies can be bypassed via process.binding (Medium) CVE-2023-32005 CVE-2023-32005: fs.statfs can bypass the permission model (Low) CVE-2023-32003 CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low) Publisher severity No explicit severity was extracted.
Event #27124 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:20:22 GMT
Publisher date Wed, 09 Aug 2023 17:55:32 GMT Read the original announcement Node.js 20.8.0 reworks memory management for vm APIs that use importModuleDynamically, addressing long-standing memory leaks and use-after-free issues.
Announced 29 Sept 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This rework addressed a series of long-standing memory leaks and use-after-free issues in the following APIs that support importModuleDynamically: Node.js Node.js 20.8.0 (Current)
Affected versions Not stated in this extraction Fixed versions 20.8.0 Node.js 20.8.0 (Current) Prerequisites importModuleDynamically APIs that support importModuleDynamically Publisher severity No explicit severity was extracted.
Event #26665 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:12:36 GMT
Publisher date Fri, 29 Sep 2023 03:26:00 GMT Read the original announcement Security updates are available for Node.js 18.x and 20.x, addressing vulnerabilities in undici, nghttp2, and Node.js features. Downloads include Node.js v18.18.2 and v20.8.1.
Announced 13 Oct 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v18.x and v20.x Node.js release lines for the following issues. Node.js Node.js v20.8.1 (Current) Affected versions 18.x This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x. 20.x This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x. Fixed versions v20.8.1 Node.js v20.8.1 (Current) v18.18.2 Node.js v18.18.2 (LTS) Prerequisites experimental permission model This vulnerability affects all users using the experimental permission model in Node.js 20.x. experimental policy mechanism This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. --experimental-wasm-modules command line option This vulnerability affects users of the --experimental-wasm-modules command line option in all active release lines 18.x and 20.x. Related CVEs CVE-2023-45143 undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143) CVE-2023-44487 nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487) CVE-2023-39331 Permission model improperly protects against path traversal (High) - (CVE-2023-39331) CVE-2023-39332 Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332) CVE-2023-38552 Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552) CVE-2023-39333 Code injection via WebAssembly export names (Low) - (CVE-2023-39333) Publisher severity high
2 high severity issues.
Event #26545 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:10:24 GMT
Publisher date Fri, 13 Oct 2023 13:30:00 GMT Read the original announcement Node.js 20.8.1 fixes multiple security vulnerabilities, including issues involving nghttp2, undici, path traversal, policy integrity checks, and WebAssembly export names.
Announced 13 Oct 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 20.8.1 (Current)
Affected versions Not stated in this extraction Fixed versions 20.8.1 Node.js 20.8.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-44487 CVE-2023-44487: nghttp2 Security Release (High) CVE-2023-45143 CVE-2023-45143: undici Security Release (High) CVE-2023-39332 CVE-2023-39332: Path traversal through path stored in Uint8Array (High) CVE-2023-39331 CVE-2023-39331: Permission model improperly protects against path traversal (High) CVE-2023-38552 CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium) CVE-2023-39333 CVE-2023-39333: Code injection via WebAssembly export names (Low) Publisher severity No explicit severity was extracted.
Event #26544 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:10:19 GMT
Publisher date Fri, 13 Oct 2023 21:08:42 GMT Read the original announcement Node.js 18.18.2 fixes four listed security vulnerabilities.
Announced 13 Oct 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 18.18.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.18.2 Node.js 18.18.2 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-44487 CVE-2023-44487: nghttp2 Security Release (High) CVE-2023-45143 CVE-2023-45143: undici Security Release (High) CVE-2023-38552 CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium) CVE-2023-39333 CVE-2023-39333: Code injection via WebAssembly export names (Low) Publisher severity No explicit severity was extracted.
Event #26363 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:07:18 GMT
Publisher date Fri, 13 Oct 2023 21:09:24 GMT Read the original announcement Node.js 21.0.0 includes stricter HTTP parsing defaults that the announcement says enhance security, including mandatory CRLF after headers and chunks and rejecting data after a message with the Connection: close header. The --insecure-http-parser flag can disable these changes.
Announced 17 Oct 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context With the latest update, all settings that were previously included in strict mode are enabled by default, enhancing code reliability and security. Node.js Node.js 21 is now available!
Affected versions Not stated in this extraction Fixed versions Node.js 21.0.0 To download Node.js 21.0.0, visit:
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #26182 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:04:37 GMT
Publisher date Tue, 17 Oct 2023 15:45:00 GMT Read the original announcement Node.js 18.19.1 is a security release addressing several vulnerabilities, including code injection and privilege escalation, denial of service, and a timing attack. The release explicitly rates some issues High and others Medium.
Announced 14 Feb 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 18.19.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.19.1 Version 18.19.1 'Hydrogen' (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-21892 CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) CVE-2024-22019 CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) CVE-2023-46809 CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) CVE-2024-22025 CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) Publisher severity No explicit severity was extracted.
Event #24996 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:44:21 GMT
Publisher date Wed, 14 Feb 2024 17:35:50 GMT Read the original announcement Node.js 21.6.2 is a security release addressing multiple vulnerabilities, including code injection, denial of service, path traversal, privilege escalation, and permission model bypasses.
Announced 14 Feb 2024
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 21.6.2 (Current)
Affected versions Not stated in this extraction Fixed versions 21.6.2 Version 21.6.2 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2024-21892 CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) CVE-2024-22019 CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) CVE-2024-21896 CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High) CVE-2024-22017 CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High) CVE-2023-46809 CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) CVE-2024-21891 CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium) CVE-2024-21890 CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium) CVE-2024-22025 CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) Publisher severity No explicit severity was extracted.
Event #24995 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 06:44:20 GMT
Publisher date Wed, 14 Feb 2024 17:36:06 GMT Read the original announcement 