25 October 2026 Node.js security releases address multiple vulnerabilities in the 14.x, 16.x, and 18.x release lines. Downloads are listed for Node.js v14.20.0, v16.16.0, and v18.5.0.
Announced 7 Jul 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues. Node.js Node.js v14.20.0 (LTS) Affected versions All versions of the 18.x, 16.x, and 14.x releases lines Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. Fixed versions Node.js v14.20.0 (LTS) Node.js v14.20.0 (LTS) Node.js v16.16.0 (LTS) Node.js v16.16.0 (LTS) Node.js v18.5.0 (Current) Node.js v18.5.0 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-32213 HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213) CVE-2022-32214 HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214) CVE-2022-32215 HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215) CVE-2022-32212 DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212) CVE-2022-32223 DLL Hijacking on Windows (High)(CVE-2022-32223) CVE-2022-32222 Attempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)(CVE-2022-32222) CVE-2022-2097 OpenSSL - AES OCB fails to encrypt some bytes (Medium)(CVE-2022-2097) Publisher severity No explicit severity was extracted.
Event #31728 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:37:27 GMT
Publisher date Thu, 07 Jul 2022 16:00:00 GMT Read the original announcement Node.js 14.20.0 updates its bundled OpenSSL sources to 1.1.1q and includes stricter Transfer-Encoding and header separator parsing.
Announced 7 Jul 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context deps: upgrade openssl sources to 1.1.1q Node.js Node.js 14.20.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.20.0 Node.js 14.20.0 (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #31502 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:33:21 GMT
Publisher date Thu, 07 Jul 2022 16:08:08 GMT Read the original announcement Node.js released security updates for the 18.x, 16.x, and 14.x release lines addressing DNS rebinding, HTTP request smuggling, and other vulnerabilities.
Announced 15 Sept 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues. Node.js Node.js v14.20.1 (LTS) Affected versions All versions of the 18.x, 16.x, and 14.x release lines Impacts: All versions of the 18.x, 16.x, and 14.x release lines. Fixed versions Node.js v14.20.1 (LTS) Node.js v14.20.1 (LTS) Node.js v16.17.1 (LTS) Node.js v16.17.1 (LTS) Node.js v18.9.1 (Current) Node.js v18.9.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-32212 DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) CVE-2018-7160 DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) (High) (CVE-2022-32212, CVE-2018-7160) CVE-2022-32213 CVE-2022-32213 bypass via obs-fold mechanic (Medium) (CVE-2022-32213) CVE-2022-35256 HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) (CVE-2022-35256) CVE-2022-32222 Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on macOS (Medium) (CVE-2022-32222) CVE-2022-35255 Weak randomness in WebCrypto keygen (High) (CVE-2022-35255) Publisher severity No explicit severity was extracted.
Event #31124 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:27:25 GMT
Publisher date Thu, 15 Sep 2022 16:00:00 GMT Read the original announcement Node.js 14.20.1 fixes three listed CVEs, including DNS rebinding in --inspect on macOS and HTTP request smuggling.
Announced 23 Sept 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 14.20.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.20.1 Node.js 14.20.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-32212 CVE-2022-32212: DNS rebinding in --inspect on macOS (High) CVE-2022-32213 CVE-2022-32213: bypass via obs-fold mechanic (Medium) CVE-2022-35256 CVE-2022-35256: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) Publisher severity No explicit severity was extracted.
Event #30913 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:23:35 GMT
Publisher date Fri, 23 Sep 2022 16:13:35 GMT Read the original announcement Node.js 18.9.1 fixes multiple security vulnerabilities, including DNS rebinding, OpenSSL configuration file handling, HTTP request smuggling, and weak randomness in WebCrypto key generation.
Announced 23 Sept 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 18.9.1 (Current)
Affected versions Not stated in this extraction Fixed versions 18.9.1 Node.js 18.9.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-32212 CVE-2022-32212: DNS rebinding in --inspect on macOS (High) CVE-2022-32222 CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium) CVE-2022-32213 CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium) CVE-2022-32215 CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium) CVE-2022-35256 CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium) CVE-2022-35255 CVE-2022-35255: Weak randomness in WebCrypto keygen Publisher severity No explicit severity was extracted.
Event #30896 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:23:22 GMT
Publisher date Fri, 23 Sep 2022 16:14:04 GMT Read the original announcement Node.js 16.18.0 (LTS) includes security vulnerability fixes; the announcement refers readers to the September 22nd 2022 Security Releases blog post for details.
Announced 12 Oct 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post. Node.js Node.js 16.18.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.18.0 Node.js 16.18.0 (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #30784 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:21:22 GMT
Publisher date Wed, 12 Oct 2022 14:50:38 GMT Read the original announcement Node.js 18.10.0 includes a fix for an out-of-bounds read in ClientHelloParser.
Announced 28 Sept 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context tls: fix out-of-bounds read in ClientHelloParser Node.js Node.js 18.10.0 (Current)
Affected versions Not stated in this extraction Fixed versions 18.10.0 Node.js 18.10.0 (Current)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #30685 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:19:41 GMT
Publisher date Wed, 28 Sep 2022 17:40:35 GMT Read the original announcement Node.js assessed the OpenSSL and zlib vulnerabilities and determined that they do not affect Node.js.
Announced 24 Oct 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The vulnerability in the OpenSSL Security release of Oct 11 2022 does not affect any active Node.js release lines, as well as the zlib vulnerability (CVE-2022-37434) patched on the zlib Security release of Oct 13 2022, does not affect Node.js. Node.js The vulnerability in the OpenSSL Security release of Oct 11 2022 does not affect any active Node.js release lines
Affected versions Not stated in this extraction
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3358 Using a Custom Cipher with NID_undef may lead to NULL encryption (CVE-2022-3358) CVE-2022-37434 the zlib vulnerability (CVE-2022-37434) patched on the zlib Security release of Oct 13 2022 Publisher severity No explicit severity was extracted.
Event #30384 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:14:21 GMT
Publisher date Mon, 24 Oct 2022 20:00:15 GMT Read the original announcement Node.js security updates address three vulnerabilities, including OpenSSL certificate buffer overflows and DNS rebinding through --inspect. Updates are available in the listed release versions.
Announced 1 Nov 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for v14,x, v16.x, v18.x and v19.x Node.js release lines for the following issues. Node.js Node.js v14.21.1 (LTS) Affected versions All versions of the v14.x, v16.x, v18.x, and v19.x releases lines Impacts: All versions of the v14.x, v16.x, v18.x, and v19.x releases lines. Fixed versions v14.21.1 Node.js v14.21.1 (LTS) v16.18.1 Node.js v16.18.1 (LTS) v18.12.1 Node.js v18.12.1 (LTS) v19.0.1 Node.js v19.0.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3602 X.509 Email Address 4-byte Buffer Overflow (High) (CVE-2022-3602) CVE-2022-3786 X.509 Email Address Variable Length Buffer Overflow (High) (CVE-2022-3786) CVE-2022-43548 DNS rebinding in --inspect via invalid octal IP address (Medium) (CVE-2022-43548) Publisher severity No explicit severity was extracted.
Event #30005 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:08:22 GMT
Publisher date Tue, 01 Nov 2022 21:00:00 GMT Read the original announcement This release fixes a DNS rebinding vulnerability involving the inspector and invalid octal IP addresses.
Announced 4 Nov 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Node.js Node.js 16.18.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.18.1 Node.js 16.18.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-43548 CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Publisher severity No explicit severity was extracted.
Event #29869 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:06:21 GMT
Publisher date Fri, 04 Nov 2022 17:53:46 GMT Read the original announcement Node.js 18.12.1 fixes three reported vulnerabilities, including X.509 buffer overflows and DNS rebinding through --inspect.
Announced 4 Nov 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Node.js Node.js 18.12.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.12.1 Node.js 18.12.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3602 CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786 CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548 CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Publisher severity No explicit severity was extracted.
Event #29781 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:04:32 GMT
Publisher date Fri, 04 Nov 2022 22:34:29 GMT Read the original announcement Node.js 19.0.1 fixes three listed vulnerabilities, including two rated High and one rated Medium.
Announced 4 Nov 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Node.js Node.js 19.0.1 (Current)
Affected versions Not stated in this extraction Fixed versions 19.0.1 Node.js 19.0.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3602 CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786 CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548 CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Publisher severity No explicit severity was extracted.
Event #29776 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:04:26 GMT
Publisher date Fri, 04 Nov 2022 18:05:19 GMT Read the original announcement Node.js is not affected by the cited OpenSSL vulnerability because it does not use the relevant OpenSSL command-line flag or functions.
Announced 16 Dec 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Therefore, Node.js is not affected by this vulnerability. Node.js Node.js is not affected by this vulnerability.
Affected versions Not stated in this extraction
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3996 X.509 Policy Constraints Double Locking (CVE-2022-3996) Publisher severity No explicit severity was extracted.
Event #29398 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:58:20 GMT
Publisher date Fri, 16 Dec 2022 17:00:15 GMT Read the original announcement Node.js security releases address OpenSSL updates and multiple vulnerabilities across the 14.x, 16.x, 18.x, and 19.x release lines. Released versions are listed below.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues. Node.js Node.js v14.21.3 (LTS) Affected versions 19.x All versions of the 19.x, 18.x, 16.x, and 14.x release lines. 18.x All versions of the 19.x, 18.x, 16.x, and 14.x release lines. 16.x All versions of the 19.x, 18.x, 16.x, and 14.x release lines. 14.x All versions of the 19.x, 18.x, 16.x, and 14.x release lines. Fixed versions v14.21.3 Node.js v14.21.3 (LTS) v16.19.1 Node.js v16.19.1 (LTS) v18.14.1 Node.js v18.14.1 (LTS) v19.6.1 Node.js v19.6.1 (Current) Prerequisites --experimental-policy This only affects users who had enabled the experimental permissions option with --experimental-policy. Related CVEs CVE-2023-23918 Node.js Permissions policies can be bypassed via process.mainModule (High) (CVE-2023-23918) CVE-2023-23919 Node.js OpenSSL error handling issues in nodejs crypto library (Medium) (CVE-2023-23919) CVE-2023-23936 Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) (CVE-2023-23936) CVE-2023-24807 Regular Expression Denial of Service in Headers in Node.js fetch API(Low) (CVE-2023-24807) CVE-2023-23920 Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) (CVE-2023-23920) Publisher severity No explicit severity was extracted.
Event #29062 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:52:20 GMT
Publisher date Thu, 16 Feb 2023 21:00:00 GMT Read the original announcement Node.js 14.21.3 fixes security vulnerabilities, includes OpenSSL security updates, and updates npm.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js 14 This security release also includes an npm update for Node.js 14
Affected versions Not stated in this extraction Fixed versions 14.21.3 Node.js 14.21.3 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-23918 CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920 CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) Publisher severity No explicit severity was extracted.
Event #28975 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:51:21 GMT
Publisher date Thu, 16 Feb 2023 22:08:13 GMT Read the original announcement Node.js 16.19.1 (LTS) fixes several security vulnerabilities, including issues in permissions policies, crypto, ICU data loading, and the Fetch API.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 16.19.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.19.1 Node.js 16.19.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-23918 CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23919 CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium) CVE-2023-23920 CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) CVE-2023-23936 CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) CVE-2023-24807 CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low) Publisher severity No explicit severity was extracted.
Event #28880 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:49:37 GMT
Publisher date Thu, 16 Feb 2023 22:16:31 GMT Read the original announcement Node.js 19.6.1 fixes multiple security vulnerabilities, including three CVEs, and includes OpenSSL security updates.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2023-23919: OpenSSL errors not cleared in error stack (Medium) CVE-2023-23918: Experimental Policies bypass via process.mainModule.require(High) CVE-2023-23920: Insecure loading of ICU data through ICU_DATA environment variable (Low) Node.js Node.js 19.6.1 (Current)
Affected versions Not stated in this extraction Fixed versions 19.6.1 Node.js 19.6.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-23919 CVE-2023-23919: OpenSSL errors not cleared in error stack (Medium) CVE-2023-23918 CVE-2023-23918: Experimental Policies bypass via process.mainModule.require(High) CVE-2023-23920 CVE-2023-23920: Insecure loading of ICU data through ICU_DATA environment variable (Low) Publisher severity No explicit severity was extracted.
Event #28862 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:49:22 GMT
Publisher date Thu, 16 Feb 2023 22:21:38 GMT Read the original announcement Node.js 18.14.1 fixes five listed CVEs and includes OpenSSL security updates.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 18.14.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.14.1 Node.js 18.14.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2023-23918 CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23919 CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium) CVE-2023-23936 CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) CVE-2023-24807 CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low) CVE-2023-23920 CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) Publisher severity No explicit severity was extracted.
Event #28760 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:47:41 GMT
Publisher date Thu, 16 Feb 2023 22:22:52 GMT Read the original announcement Node.js 20.0.0 includes fixes described as addressing vulnerabilities in its experimental Permission Model.
Announced 18 Apr 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context permission: fix some vulnerabilities in fs (Tobias Nießen) #47091 Node.js Node.js 20.0.0 (Current)
Affected versions Not stated in this extraction Fixed versions 20.0.0 Node.js 20.0.0 (Current)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #28197 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:38:21 GMT
Publisher date Tue, 18 Apr 2023 16:07:46 GMT Read the original announcement Security updates address vulnerabilities in Node.js and bundled OpenSSL and c-ares components. Updated releases are Node.js v16.20.1, v18.16.1, and v20.3.1.
Announced 20 Jun 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for all supported Node.js release lines for the following issues. Node.js Node.js v16.20.1 (LTS) Affected versions 16.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. 18.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. 20.x This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Fixed versions Node.js v16.20.1 Node.js v16.20.1 (LTS) Node.js v18.16.1 Node.js v18.16.1 (LTS) Node.js v20.3.1 Node.js v20.3.1 (Current) Prerequisites using the experimental policy mechanism This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. using the experimental permission model This vulnerability affects all users using the experimental permission model in Node.js 20. Related CVEs CVE-2023-30581 mainModule.proto bypass experimental policy mechanism (High) (CVE-2023-30581) CVE-2023-30584 Path traversal bypass in experimental permission model (High) (CVE-2023-30584) CVE-2023-30587 Inspector protocol bypass the experimental permission model (High) (CVE-2023-30587) CVE-2023-30582 fs.watchFile bypass in experimental permission model (Medium) (CVE-2023-30582) CVE-2023-30583 fs.openAsBlob bypass in experimental permission model (Medium) (CVE-2023-30583) CVE-2023-30585 Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) (CVE-2023-30585) CVE-2023-30586 OpenSSL engines can be used to bypass the permission model (Medium) (CVE-2023-30586) CVE-2023-30588 Process interruption due to invalid Public Key information in x509 certificates (Medium) (CVE-2023-30588) CVE-2023-30589 HTTP Request Smuggling via Empty headers separated by CR (Medium) (CVE-2023-30589) CVE-2023-30590 DiffieHellman do not generate keys after setting a private key (Medium) (CVE-2023-30590) Publisher severity No explicit severity was extracted.
Event #28023 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:35:25 GMT
Publisher date Tue, 20 Jun 2023 14:30:00 GMT Read the original announcement 