25 October 2026 Node.js 12.22.11 updates OpenSSL to version 1.1.1n, addressing an infinite-loop vulnerability reachable when parsing certificates.
Announced 18 Mar 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Update to OpenSSL 1.1.1n, which addresses the following vulnerability: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (High)(CVE-2022-0778) Node.js Node.js 12.22.11 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.11 Node.js 12.22.11 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-0778 CVE-2022-0778 Publisher severity No explicit severity was extracted.
Event #33699 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:10:21 GMT
Publisher date Fri, 18 Mar 2022 01:10:50 GMT Read the original announcement Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.
Announced 18 Mar 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL. Node.js Node.js v12.22.11 (LTS) Affected versions 17.x Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. 16.x Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. 14.x Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. 12.x Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. Fixed versions v12.22.11 Node.js v12.22.11 (LTS) v14.19.1 Node.js v14.19.1 (LTS) v16.14.2 Node.js v16.14.2 (LTS) v17.7.2 Node.js v17.7.2 (Current)
Prerequisites Not stated in this extraction OpenSSL Update to OpenSSL 3.0.2n and 1.1.1n
Affected versions Not stated in this extraction Fixed versions 3.0.2n Update to OpenSSL 3.0.2n and 1.1.1n 1.1.1n Update to OpenSSL 3.0.2n and 1.1.1n
Prerequisites Not stated in this extraction Related CVEs CVE-2022-0778 (High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates. Publisher severity high
The 17.x release line of Node.js is vulnerable to one High severity issue.
Event #33187 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:01:30 GMT
Publisher date Fri, 18 Mar 2022 01:52:00 GMT Read the original announcement This Node.js release fixes a shutdown crash in Node-API and a potential stack overflow in vm.runInNewContext().
Announced 5 Apr 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This release fixes a shutdown crash in Node-API (formerly N-API) and a potential stack overflow when using vm.runInNewContext(). Node.js Node.js 12.22.12 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.12 Node.js 12.22.12 (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #33013 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:58:43 GMT
Publisher date Tue, 05 Apr 2022 12:19:10 GMT Read the original announcement Node.js 14.19.2 includes a V8 fix for a stack overflow issue affecting the vm module. The release also fixes a crash caused by using getHeapSnapshot().
Announced 4 May 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context V8 had a stack overflow issue affecting the vm module, cherry-picking cc9a8a37445e from V8 solves this issue. Node.js Node.js 14.19.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.19.2 Node.js 14.19.2 (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #32862 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:56:21 GMT
Publisher date Wed, 04 May 2022 17:12:06 GMT Read the original announcement Node.js 18.2.0 updates OpenSSL to 3.0.3 and is identified as a security release because issues addressed in that OpenSSL update slightly affect Node.js 18.
Announced 17 May 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This update can be treated as a security release as the issues addressed in OpenSSL 3.0.3 slightly affect Node.js 18. Node.js Node.js 18.2.0 (Current)
Affected versions Not stated in this extraction Fixed versions 18.2.0 Node.js 18.2.0 (Current)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #32345 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:47:35 GMT
Publisher date Tue, 17 May 2022 15:49:02 GMT Read the original announcement Node.js 17.9.1 updates OpenSSL to 3.0.3 and is described as a security release because issues addressed in OpenSSL 3.0.3 slightly affect Node.js 17.
Announced 2 Jun 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This update can be treated as a security release as the issues addressed in OpenSSL 3.0.3 slightly affect Node.js 17. Node.js Node.js 17.9.1 (Current)
Affected versions Not stated in this extraction Fixed versions 17.9.1 Node.js 17.9.1 (Current)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #32226 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:45:46 GMT
Publisher date Thu, 02 Jun 2022 00:49:20 GMT Read the original announcement Node.js security releases address multiple vulnerabilities in the 14.x, 16.x, and 18.x release lines. Downloads are listed for Node.js v14.20.0, v16.16.0, and v18.5.0.
Announced 7 Jul 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues. Node.js Node.js v14.20.0 (LTS) Affected versions All versions of the 18.x, 16.x, and 14.x releases lines Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. Fixed versions Node.js v14.20.0 (LTS) Node.js v14.20.0 (LTS) Node.js v16.16.0 (LTS) Node.js v16.16.0 (LTS) Node.js v18.5.0 (Current) Node.js v18.5.0 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-32213 HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213) CVE-2022-32214 HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214) CVE-2022-32215 HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215) CVE-2022-32212 DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212) CVE-2022-32223 DLL Hijacking on Windows (High)(CVE-2022-32223) CVE-2022-32222 Attempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)(CVE-2022-32222) CVE-2022-2097 OpenSSL - AES OCB fails to encrypt some bytes (Medium)(CVE-2022-2097) Publisher severity No explicit severity was extracted.
Event #31728 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:37:27 GMT
Publisher date Thu, 07 Jul 2022 16:00:00 GMT Read the original announcement Node.js 14.20.0 updates its bundled OpenSSL sources to 1.1.1q and includes stricter Transfer-Encoding and header separator parsing.
Announced 7 Jul 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context deps: upgrade openssl sources to 1.1.1q Node.js Node.js 14.20.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.20.0 Node.js 14.20.0 (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #31502 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:33:21 GMT
Publisher date Thu, 07 Jul 2022 16:08:08 GMT Read the original announcement Node.js released security updates for the 18.x, 16.x, and 14.x release lines addressing DNS rebinding, HTTP request smuggling, and other vulnerabilities.
Announced 15 Sept 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues. Node.js Node.js v14.20.1 (LTS) Affected versions All versions of the 18.x, 16.x, and 14.x release lines Impacts: All versions of the 18.x, 16.x, and 14.x release lines. Fixed versions Node.js v14.20.1 (LTS) Node.js v14.20.1 (LTS) Node.js v16.17.1 (LTS) Node.js v16.17.1 (LTS) Node.js v18.9.1 (Current) Node.js v18.9.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-32212 DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) CVE-2018-7160 DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) (High) (CVE-2022-32212, CVE-2018-7160) CVE-2022-32213 CVE-2022-32213 bypass via obs-fold mechanic (Medium) (CVE-2022-32213) CVE-2022-35256 HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) (CVE-2022-35256) CVE-2022-32222 Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on macOS (Medium) (CVE-2022-32222) CVE-2022-35255 Weak randomness in WebCrypto keygen (High) (CVE-2022-35255) Publisher severity No explicit severity was extracted.
Event #31124 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:27:25 GMT
Publisher date Thu, 15 Sep 2022 16:00:00 GMT Read the original announcement Node.js 14.20.1 fixes three listed CVEs, including DNS rebinding in --inspect on macOS and HTTP request smuggling.
Announced 23 Sept 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 14.20.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.20.1 Node.js 14.20.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-32212 CVE-2022-32212: DNS rebinding in --inspect on macOS (High) CVE-2022-32213 CVE-2022-32213: bypass via obs-fold mechanic (Medium) CVE-2022-35256 CVE-2022-35256: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) Publisher severity No explicit severity was extracted.
Event #30913 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:23:35 GMT
Publisher date Fri, 23 Sep 2022 16:13:35 GMT Read the original announcement Node.js 18.9.1 fixes multiple security vulnerabilities, including DNS rebinding, OpenSSL configuration file handling, HTTP request smuggling, and weak randomness in WebCrypto key generation.
Announced 23 Sept 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: Node.js Node.js 18.9.1 (Current)
Affected versions Not stated in this extraction Fixed versions 18.9.1 Node.js 18.9.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-32212 CVE-2022-32212: DNS rebinding in --inspect on macOS (High) CVE-2022-32222 CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium) CVE-2022-32213 CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium) CVE-2022-32215 CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium) CVE-2022-35256 CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium) CVE-2022-35255 CVE-2022-35255: Weak randomness in WebCrypto keygen Publisher severity No explicit severity was extracted.
Event #30896 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:23:22 GMT
Publisher date Fri, 23 Sep 2022 16:14:04 GMT Read the original announcement Node.js 16.18.0 (LTS) includes security vulnerability fixes; the announcement refers readers to the September 22nd 2022 Security Releases blog post for details.
Announced 12 Oct 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post. Node.js Node.js 16.18.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.18.0 Node.js 16.18.0 (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #30784 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:21:22 GMT
Publisher date Wed, 12 Oct 2022 14:50:38 GMT Read the original announcement Node.js 18.10.0 includes a fix for an out-of-bounds read in ClientHelloParser.
Announced 28 Sept 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context tls: fix out-of-bounds read in ClientHelloParser Node.js Node.js 18.10.0 (Current)
Affected versions Not stated in this extraction Fixed versions 18.10.0 Node.js 18.10.0 (Current)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #30685 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:19:41 GMT
Publisher date Wed, 28 Sep 2022 17:40:35 GMT Read the original announcement Node.js assessed the OpenSSL and zlib vulnerabilities and determined that they do not affect Node.js.
Announced 24 Oct 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The vulnerability in the OpenSSL Security release of Oct 11 2022 does not affect any active Node.js release lines, as well as the zlib vulnerability (CVE-2022-37434) patched on the zlib Security release of Oct 13 2022, does not affect Node.js. Node.js The vulnerability in the OpenSSL Security release of Oct 11 2022 does not affect any active Node.js release lines
Affected versions Not stated in this extraction
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3358 Using a Custom Cipher with NID_undef may lead to NULL encryption (CVE-2022-3358) CVE-2022-37434 the zlib vulnerability (CVE-2022-37434) patched on the zlib Security release of Oct 13 2022 Publisher severity No explicit severity was extracted.
Event #30384 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:14:21 GMT
Publisher date Mon, 24 Oct 2022 20:00:15 GMT Read the original announcement Node.js security updates address three vulnerabilities, including OpenSSL certificate buffer overflows and DNS rebinding through --inspect. Updates are available in the listed release versions.
Announced 1 Nov 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for v14,x, v16.x, v18.x and v19.x Node.js release lines for the following issues. Node.js Node.js v14.21.1 (LTS) Affected versions All versions of the v14.x, v16.x, v18.x, and v19.x releases lines Impacts: All versions of the v14.x, v16.x, v18.x, and v19.x releases lines. Fixed versions v14.21.1 Node.js v14.21.1 (LTS) v16.18.1 Node.js v16.18.1 (LTS) v18.12.1 Node.js v18.12.1 (LTS) v19.0.1 Node.js v19.0.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3602 X.509 Email Address 4-byte Buffer Overflow (High) (CVE-2022-3602) CVE-2022-3786 X.509 Email Address Variable Length Buffer Overflow (High) (CVE-2022-3786) CVE-2022-43548 DNS rebinding in --inspect via invalid octal IP address (Medium) (CVE-2022-43548) Publisher severity No explicit severity was extracted.
Event #30005 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:08:22 GMT
Publisher date Tue, 01 Nov 2022 21:00:00 GMT Read the original announcement This release fixes a DNS rebinding vulnerability involving the inspector and invalid octal IP addresses.
Announced 4 Nov 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Node.js Node.js 16.18.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.18.1 Node.js 16.18.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-43548 CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Publisher severity No explicit severity was extracted.
Event #29869 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:06:21 GMT
Publisher date Fri, 04 Nov 2022 17:53:46 GMT Read the original announcement Node.js 18.12.1 fixes three reported vulnerabilities, including X.509 buffer overflows and DNS rebinding through --inspect.
Announced 4 Nov 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Node.js Node.js 18.12.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 18.12.1 Node.js 18.12.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3602 CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786 CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548 CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Publisher severity No explicit severity was extracted.
Event #29781 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:04:32 GMT
Publisher date Fri, 04 Nov 2022 22:34:29 GMT Read the original announcement Node.js 19.0.1 fixes three listed vulnerabilities, including two rated High and one rated Medium.
Announced 4 Nov 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context The following CVEs are fixed in this release: CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Node.js Node.js 19.0.1 (Current)
Affected versions Not stated in this extraction Fixed versions 19.0.1 Node.js 19.0.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3602 CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786 CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548 CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium) Publisher severity No explicit severity was extracted.
Event #29776 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:04:26 GMT
Publisher date Fri, 04 Nov 2022 18:05:19 GMT Read the original announcement Node.js is not affected by the cited OpenSSL vulnerability because it does not use the relevant OpenSSL command-line flag or functions.
Announced 16 Dec 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Therefore, Node.js is not affected by this vulnerability. Node.js Node.js is not affected by this vulnerability.
Affected versions Not stated in this extraction
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2022-3996 X.509 Policy Constraints Double Locking (CVE-2022-3996) Publisher severity No explicit severity was extracted.
Event #29398 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:58:20 GMT
Publisher date Fri, 16 Dec 2022 17:00:15 GMT Read the original announcement Node.js security releases address OpenSSL updates and multiple vulnerabilities across the 14.x, 16.x, 18.x, and 19.x release lines. Released versions are listed below.
Announced 16 Feb 2023
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues. Node.js Node.js v14.21.3 (LTS) Affected versions 19.x All versions of the 19.x, 18.x, 16.x, and 14.x release lines. 18.x All versions of the 19.x, 18.x, 16.x, and 14.x release lines. 16.x All versions of the 19.x, 18.x, 16.x, and 14.x release lines. 14.x All versions of the 19.x, 18.x, 16.x, and 14.x release lines. Fixed versions v14.21.3 Node.js v14.21.3 (LTS) v16.19.1 Node.js v16.19.1 (LTS) v18.14.1 Node.js v18.14.1 (LTS) v19.6.1 Node.js v19.6.1 (Current) Prerequisites --experimental-policy This only affects users who had enabled the experimental permissions option with --experimental-policy. Related CVEs CVE-2023-23918 Node.js Permissions policies can be bypassed via process.mainModule (High) (CVE-2023-23918) CVE-2023-23919 Node.js OpenSSL error handling issues in nodejs crypto library (Medium) (CVE-2023-23919) CVE-2023-23936 Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) (CVE-2023-23936) CVE-2023-24807 Regular Expression Denial of Service in Headers in Node.js fetch API(Low) (CVE-2023-24807) CVE-2023-23920 Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) (CVE-2023-23920) Publisher severity No explicit severity was extracted.
Event #29062 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 07:52:20 GMT
Publisher date Thu, 16 Feb 2023 21:00:00 GMT Read the original announcement 