25 October 2026 Node.js 16.6.2 addresses reported security issues involving DNS hostname handling, HTTP/2 stream cancellation, and HTTPS certificate validation.
Announced 11 Aug 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High) Node.js Node.js 16.6.2 (Current)
Affected versions Not stated in this extraction Fixed versions 16.6.2 Node.js 16.6.2 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-3672 CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High) CVE-2021-22931 CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High) CVE-2021-22940 CVE-2021-22940: Use after free on close http2 on stream canceling (High) CVE-2021-22939 CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low) Publisher severity No explicit severity was extracted.
Event #36922 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:03:20 GMT
Publisher date Wed, 11 Aug 2021 16:42:12 GMT Read the original announcement Node.js 14.17.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including node-tar and npm arborist.
Announced 31 Aug 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context These are vulnerabilities in the node-tar, arborist, and npm cli modules Node.js Node.js 14.17.6 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.17.6 Node.js 14.17.6 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-37701 CVE-2021-37701 CVE-2021-37712 CVE-2021-37712 CVE-2021-37713 CVE-2021-37713 CVE-2021-39134 CVE-2021-39134 CVE-2021-39135 CVE-2021-39135 Publisher severity No explicit severity was extracted.
Event #36742 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:00:51 GMT
Publisher date Tue, 31 Aug 2021 15:03:39 GMT Read the original announcement Security updates for Node.js 12.x and 14.x address vulnerabilities in node-tar and other issues. The announcement lists Node.js v12.22.6 and v14.17.6 as releases.
Announced 31 Aug 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Security releases available Updates are now available for v14.x, and v12.x Node.js release lines for the following issues. Node.js Node.js release lines Affected versions 14.x The 14.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues 12.x The 12.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues Fixed versions v12.22.6 Node.js v12.22.6 (LTS) v14.17.6 Node.js v14.17.6 (LTS)
Prerequisites Not stated in this extraction npm npm 6 update - node-tar Affected versions npm 6 npm 6 update - node-tar
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2021-37701 CVE-2021-37701 CVE-2021-37712 CVE-2021-37712 CVE-2021-37713 CVE-2021-37713 CVE-2021-32803 CVE-2021-32803 CVE-2021-32804 CVE-2021-32804 Publisher severity No explicit severity was extracted.
Event #36712 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:00:24 GMT
Publisher date Tue, 31 Aug 2021 16:00:00 GMT Read the original announcement Node.js 12.22.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including issues associated with five listed CVEs.
Announced 31 Aug 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Node.js Node.js 12.22.6 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.6 Node.js 12.22.6 (LTS)
Prerequisites Not stated in this extraction npm deps: upgrade npm to 6.14.15
Affected versions Not stated in this extraction Fixed versions 6.14.15 deps: upgrade npm to 6.14.15
Prerequisites Not stated in this extraction Related CVEs CVE-2021-32803 node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804 CVE-2021-32804 node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804 CVE-2021-37701 CVE-2021-37701 CVE-2021-37712 CVE-2021-37712 CVE-2021-37713 CVE-2021-37713 CVE-2021-39134 CVE-2021-39134 CVE-2021-39135 CVE-2021-39135 Publisher severity No explicit severity was extracted.
Event #36619 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:58:21 GMT
Publisher date Tue, 31 Aug 2021 15:03:32 GMT Read the original announcement Node.js 16.11.1 addresses two HTTP request smuggling issues involving spaces in headers and parsing chunked request bodies.
Announced 12 Oct 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) Node.js Node.js 16.11.1 (Current)
Affected versions Not stated in this extraction Fixed versions 16.11.1 Node.js 16.11.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22959 CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) CVE-2021-22960 CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium) Publisher severity No explicit severity was extracted.
Event #36236 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:52:23 GMT
Publisher date Tue, 12 Oct 2021 15:35:28 GMT Read the original announcement Node.js 14.18.1 addresses two HTTP request smuggling issues involving spaces before header colons and chunked request body parsing.
Announced 12 Oct 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js 14.18.1 (LTS) Notable changes CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) Node.js Node.js 14.18.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.18.1 Node.js 14.18.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22959 CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) CVE-2021-22960 CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium) Publisher severity No explicit severity was extracted.
Event #35957 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:47:23 GMT
Publisher date Tue, 12 Oct 2021 15:35:37 GMT Read the original announcement Node.js 12.22.7 (LTS) addresses HTTP request smuggling issues involving spaces in headers and chunked request body parsing.
Announced 12 Oct 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js 12.22.7 (LTS) Notable changes CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). Node.js Node.js 12.22.7 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.7 Node.js 12.22.7 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22959 CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) CVE-2021-22960 CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium) Publisher severity No explicit severity was extracted.
Event #35956 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:47:23 GMT
Publisher date Tue, 12 Oct 2021 15:35:54 GMT Read the original announcement Node.js released updates addressing two HTTP request smuggling issues across the 12.x, 14.x, and 16.x release lines.
Announced 12 Oct 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v16.x, v14.x, and v12.x Node.js release lines for the following issues. Node.js Node.js v12.22.7 (LTS) Affected versions All versions of the 16.x, 14.x, and 12.x releases lines. Impacts: All versions of the 16.x, 14.x, and 12.x releases lines. Fixed versions Node.js v12.22.7 (LTS) Node.js v12.22.7 (LTS) Node.js v14.18.1 (LTS) Node.js v14.18.1 (LTS) Node.js v16.11.1 (Current) Node.js v16.11.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22959 HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959) CVE-2021-22960 HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960) Publisher severity medium
Two medium severity issues
Event #35775 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:44:22 GMT
Publisher date Tue, 12 Oct 2021 16:00:00 GMT Read the original announcement Node.js 17.3.0 updates OpenSSL to address CVE-2021-4044, a vulnerability that may be exploited through Node.js.
Announced 17 Dec 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context OpenSSL-3.0.1 contains a fix for CVE-2021-4044: Invalid handling of X509_verify_cert() internal errors in libssl (Moderate). This is a vulnerability in OpenSSL that may be exploited through Node.js. Node.js Node.js 17.3.0 (Current)
Affected versions Not stated in this extraction Fixed versions 17.3.0 Node.js 17.3.0 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-4044 OpenSSL-3.0.1 contains a fix for CVE-2021-4044 Publisher severity No explicit severity was extracted.
Event #35114 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:33:22 GMT
Publisher date Fri, 17 Dec 2021 23:20:49 GMT Read the original announcement Node.js 12.22.9 includes fixes for certificate verification and prototype pollution vulnerabilities.
Announced 11 Jan 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js 12.22.9 (LTS) Node.js Node.js 12.22.9 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.9 Node.js 12.22.9 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-44531 Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) CVE-2021-44532 Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) CVE-2021-44533 Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) CVE-2022-21824 Prototype pollution via console.table properties (Low)(CVE-2022-21824) Publisher severity No explicit severity was extracted.
Event #35029 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:32:23 GMT
Publisher date Tue, 11 Jan 2022 00:00:46 GMT Read the original announcement Node.js 17.3.1 fixes certificate verification and prototype pollution vulnerabilities. The release identifies CVE-2021-44531, CVE-2021-44532, CVE-2021-44533, and CVE-2022-21824.
Announced 11 Jan 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js 17.3.1 (Current) Node.js Node.js 17.3.1 (Current)
Affected versions Not stated in this extraction Fixed versions 17.3.1 Node.js 17.3.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-44531 Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) CVE-2021-44532 Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) CVE-2021-44533 Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) CVE-2022-21824 Prototype pollution via console.table properties (Low)(CVE-2022-21824) Publisher severity No explicit severity was extracted.
Event #34932 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:30:50 GMT
Publisher date Tue, 11 Jan 2022 00:02:14 GMT Read the original announcement Node.js 14.18.3 includes fixes for certificate verification and prototype pollution vulnerabilities.
Announced 11 Jan 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js 14.18.3 (LTS) Notable changes Node.js Node.js 14.18.3 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.18.3 Node.js 14.18.3 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-44531 Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) CVE-2021-44532 Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) CVE-2021-44533 Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) CVE-2022-21824 Prototype pollution via console.table properties (Low)(CVE-2022-21824) Publisher severity No explicit severity was extracted.
Event #34898 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:30:23 GMT
Publisher date Tue, 11 Jan 2022 00:02:52 GMT Read the original announcement Node.js 16.13.2 (LTS) includes fixes for certificate verification and prototype pollution vulnerabilities. The release identifies medium and low severity issues.
Announced 11 Jan 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js 16.13.2 (LTS) Notable changes Node.js Node.js 16.13.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 16.13.2 Node.js 16.13.2 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-44531 Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) CVE-2021-44532 Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) CVE-2021-44533 Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) CVE-2022-21824 Prototype pollution via console.table properties (Low)(CVE-2022-21824) Publisher severity No explicit severity was extracted.
Event #34810 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:28:41 GMT
Publisher date Tue, 11 Jan 2022 00:27:39 GMT Read the original announcement Node.js security updates address three medium-severity issues and one low-severity issue across the 12.x, 14.x, 16.x, and 17.x release lines.
Announced 11 Jan 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for the v17.x, v16.x, v14.x, and v12.x Node.js release lines for the following issues. Node.js Node.js v12.22.9 (LTS) Affected versions All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. Fixed versions Node.js v12.22.9 (LTS) Node.js v12.22.9 (LTS) Node.js v14.18.3 (LTS) Node.js v14.18.3 (LTS) Node.js v16.13.2 (LTS) Node.js v16.13.2 (LTS) Node.js v17.3.1 (Current) Node.js v17.3.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-44531 Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) CVE-2021-44532 Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) CVE-2021-44533 Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) CVE-2022-21824 Prototype pollution via console.table properties (Low)(CVE-2022-21824) Publisher severity No explicit severity was extracted.
Event #34787 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:28:23 GMT
Publisher date Tue, 11 Jan 2022 00:50:00 GMT Read the original announcement Node.js 12.22.11 updates OpenSSL to version 1.1.1n, addressing an infinite-loop vulnerability reachable when parsing certificates.
Announced 18 Mar 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Update to OpenSSL 1.1.1n, which addresses the following vulnerability: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (High)(CVE-2022-0778) Node.js Node.js 12.22.11 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.11 Node.js 12.22.11 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2022-0778 CVE-2022-0778 Publisher severity No explicit severity was extracted.
Event #33699 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:10:21 GMT
Publisher date Fri, 18 Mar 2022 01:10:50 GMT Read the original announcement Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.
Announced 18 Mar 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL. Node.js Node.js v12.22.11 (LTS) Affected versions 17.x Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. 16.x Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. 14.x Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. 12.x Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines. Fixed versions v12.22.11 Node.js v12.22.11 (LTS) v14.19.1 Node.js v14.19.1 (LTS) v16.14.2 Node.js v16.14.2 (LTS) v17.7.2 Node.js v17.7.2 (Current)
Prerequisites Not stated in this extraction OpenSSL Update to OpenSSL 3.0.2n and 1.1.1n
Affected versions Not stated in this extraction Fixed versions 3.0.2n Update to OpenSSL 3.0.2n and 1.1.1n 1.1.1n Update to OpenSSL 3.0.2n and 1.1.1n
Prerequisites Not stated in this extraction Related CVEs CVE-2022-0778 (High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates. Publisher severity high
The 17.x release line of Node.js is vulnerable to one High severity issue.
Event #33187 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 09:01:30 GMT
Publisher date Fri, 18 Mar 2022 01:52:00 GMT Read the original announcement This Node.js release fixes a shutdown crash in Node-API and a potential stack overflow in vm.runInNewContext().
Announced 5 Apr 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This release fixes a shutdown crash in Node-API (formerly N-API) and a potential stack overflow when using vm.runInNewContext(). Node.js Node.js 12.22.12 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.12 Node.js 12.22.12 (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #33013 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:58:43 GMT
Publisher date Tue, 05 Apr 2022 12:19:10 GMT Read the original announcement Node.js 14.19.2 includes a V8 fix for a stack overflow issue affecting the vm module. The release also fixes a crash caused by using getHeapSnapshot().
Announced 4 May 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context V8 had a stack overflow issue affecting the vm module, cherry-picking cc9a8a37445e from V8 solves this issue. Node.js Node.js 14.19.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.19.2 Node.js 14.19.2 (LTS)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #32862 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:56:21 GMT
Publisher date Wed, 04 May 2022 17:12:06 GMT Read the original announcement Node.js 18.2.0 updates OpenSSL to 3.0.3 and is identified as a security release because issues addressed in that OpenSSL update slightly affect Node.js 18.
Announced 17 May 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This update can be treated as a security release as the issues addressed in OpenSSL 3.0.3 slightly affect Node.js 18. Node.js Node.js 18.2.0 (Current)
Affected versions Not stated in this extraction Fixed versions 18.2.0 Node.js 18.2.0 (Current)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #32345 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:47:35 GMT
Publisher date Tue, 17 May 2022 15:49:02 GMT Read the original announcement Node.js 17.9.1 updates OpenSSL to 3.0.3 and is described as a security release because issues addressed in OpenSSL 3.0.3 slightly affect Node.js 17.
Announced 2 Jun 2022
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This update can be treated as a security release as the issues addressed in OpenSSL 3.0.3 slightly affect Node.js 17. Node.js Node.js 17.9.1 (Current)
Affected versions Not stated in this extraction Fixed versions 17.9.1 Node.js 17.9.1 (Current)
Prerequisites Not stated in this extraction Publisher severity No explicit severity was extracted.
Event #32226 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 08:45:46 GMT
Publisher date Thu, 02 Jun 2022 00:49:20 GMT Read the original announcement 