OpenSSL security releases require Node.js security releases
Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL.
Node.js
Node.js v12.22.11 (LTS)
- Affected versions
- 17.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
16.xImpacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
14.xImpacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
12.xImpacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
- Fixed versions
- v12.22.11
Node.js v12.22.11 (LTS)
v14.19.1Node.js v14.19.1 (LTS)
v16.14.2Node.js v16.14.2 (LTS)
v17.7.2Node.js v17.7.2 (Current)
- Prerequisites
- Not stated in this extraction
OpenSSL
Update to OpenSSL 3.0.2n and 1.1.1n
- Affected versions
- Not stated in this extraction
- Fixed versions
- 3.0.2n
Update to OpenSSL 3.0.2n and 1.1.1n
1.1.1nUpdate to OpenSSL 3.0.2n and 1.1.1n
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2022-0778
(High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates.
Publisher severity
high
The 17.x release line of Node.js is vulnerable to one High severity issue.