July 2021 Security Releases
Node.js released security updates for the 12.x, 14.x, and 16.x release lines addressing vulnerabilities in libuv, the Windows installer, and npm dependencies.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issues.
Node.js
Node.js release lines
- Affected versions
- All versions of the 16.x, 14.x, and 12.x releases lines
Impacts: All versions of the 16.x, 14.x, and 12.x releases lines
All versions of the 12.x release lineImpacts: All versions of the 12.x release line
Versions of the 14.x release line before 14.17.0Versions of the 14.x release line before 14.17.0 which included an update to the latest npm 6.
- Fixed versions
- Node.js v12.22.2 (LTS)
Node.js v12.22.2 (LTS)
Node.js v14.17.2 (LTS)Node.js v14.17.2 (LTS)
Node.js v16.4.1 (LTS)Node.js v16.4.1 (LTS)
- Prerequisites
- Windows platforms
under certain conditions on Windows platforms
- Related CVEs
- CVE-2021-22918
Out of bounds read (Medium) (CVE-2021-22918)
CVE-2021-22921Node Installer Local Privilege Escalation (Medium) (CVE-2021-22921)
CVE-2021-27290Regular Expression Denial of Service (ReDoS) (High) (CVE-2021-27290)
CVE-2021-23362Regular Expression Denial of Service (ReDoS) (Medium) (CVE-2021-23362)
Publisher severity
No explicit severity was extracted.