Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 14.17.6 (LTS)

Node.js 14.17.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including node-tar and npm arborist.

Announced 31 Aug 2021

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

These are vulnerabilities in the node-tar, arborist, and npm cli modules

Node.js

Node.js 14.17.6 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 14.17.6
Node.js 14.17.6 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-37701
CVE-2021-37701
CVE-2021-37712
CVE-2021-37712
CVE-2021-37713
CVE-2021-37713
CVE-2021-39134
CVE-2021-39134
CVE-2021-39135
CVE-2021-39135

Publisher severity

No explicit severity was extracted.

Event: #36742 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 10:00:51 GMT
Publisher date: Tue, 31 Aug 2021 15:03:39 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 12.22.6 (LTS)

Node.js 12.22.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including issues associated with five listed CVEs.

Announced 31 Aug 2021

Node.js · Fixed in 12.22.6 npm · Fixed in 6.14.15 CVE-2021-32803 CVE-2021-32804 CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 CVE-2021-39134 CVE-2021-39135

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804.

Node.js

Node.js 12.22.6 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 12.22.6
Node.js 12.22.6 (LTS)
Prerequisites: Not stated in this extraction

npm

deps: upgrade npm to 6.14.15

Affected versions: Not stated in this extraction
Fixed versions: 6.14.15
deps: upgrade npm to 6.14.15
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-32803
node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804
CVE-2021-32804
node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804
CVE-2021-37701
CVE-2021-37701
CVE-2021-37712
CVE-2021-37712
CVE-2021-37713
CVE-2021-37713
CVE-2021-39134
CVE-2021-39134
CVE-2021-39135
CVE-2021-39135

Publisher severity

No explicit severity was extracted.

Event: #36619 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:58:21 GMT
Publisher date: Tue, 31 Aug 2021 15:03:32 GMT

Read the original announcement

advisoryUnratedNode.js announcements25 Oct 2026

Beware of End-of-Life Node.js Versions - Upgrade or Seek Post-EOL Support

Node.js 18 and earlier are unsupported and do not receive security patches. The article advises upgrading to a supported Node.js version or obtaining commercial post-EOL support.

Announced 6 Jun 2025

Node.js CVE-2025-23167 CVE-2023-5678 CVE-2024-22019 CVE-2021-39135

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 18 and all earlier versions are End-Of-Life. They are now completely unsupported, meaning they receive no updates, including security patches.

Node.js

Node.js 18 and all earlier versions are End-Of-Life.

Affected versions: 18 and all earlier versions
Node.js 18 and all earlier versions are End-Of-Life.
Fixed versions: Not stated in this extraction
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23167
https://nvd.nist.gov/vuln/detail/CVE-2025-23167 affects 18, 16, 14 (llhttp) - medium
CVE-2023-5678
https://nvd.nist.gov/vuln/detail/CVE-2023-5678 affects 16, 14 (openssl) - medium
CVE-2024-22019
https://nvd.nist.gov/vuln/detail/CVE-2024-22019 affects 16, 14 (llhttp) - high
CVE-2021-39135
https://nvd.nist.gov/vuln/detail/CVE-2021-39135 affects 14 (npm) - high

Publisher severity

No explicit severity was extracted.

Event: #19879 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:18:22 GMT
Publisher date: Fri, 06 Jun 2025 12:00:00 GMT

Read the original announcement