Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 12.22.9 (LTS)

Node.js 12.22.9 includes fixes for certificate verification and prototype pollution vulnerabilities.

Announced 11 Jan 2022

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 12.22.9 (LTS)

Node.js

Node.js 12.22.9 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 12.22.9
Node.js 12.22.9 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-44531
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
CVE-2021-44532
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
CVE-2021-44533
Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
CVE-2022-21824
Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Publisher severity

No explicit severity was extracted.

Event: #35029 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:32:23 GMT
Publisher date: Tue, 11 Jan 2022 00:00:46 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 17.3.1 (Current)

Node.js 17.3.1 fixes certificate verification and prototype pollution vulnerabilities. The release identifies CVE-2021-44531, CVE-2021-44532, CVE-2021-44533, and CVE-2022-21824.

Announced 11 Jan 2022

Node.js · Fixed in 17.3.1 CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 17.3.1 (Current)

Node.js

Node.js 17.3.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 17.3.1
Node.js 17.3.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-44531
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
CVE-2021-44532
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
CVE-2021-44533
Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
CVE-2022-21824
Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Publisher severity

No explicit severity was extracted.

Event: #34932 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:30:50 GMT
Publisher date: Tue, 11 Jan 2022 00:02:14 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 14.18.3 (LTS)

Node.js 14.18.3 includes fixes for certificate verification and prototype pollution vulnerabilities.

Announced 11 Jan 2022

Node.js · Fixed in 14.18.3 CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 14.18.3 (LTS) Notable changes

Node.js

Node.js 14.18.3 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 14.18.3
Node.js 14.18.3 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-44531
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
CVE-2021-44532
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
CVE-2021-44533
Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
CVE-2022-21824
Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Publisher severity

No explicit severity was extracted.

Event: #34898 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:30:23 GMT
Publisher date: Tue, 11 Jan 2022 00:02:52 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 16.13.2 (LTS)

Node.js 16.13.2 (LTS) includes fixes for certificate verification and prototype pollution vulnerabilities. The release identifies medium and low severity issues.

Announced 11 Jan 2022

Node.js · Fixed in 16.13.2 CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 16.13.2 (LTS) Notable changes

Node.js

Node.js 16.13.2 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 16.13.2
Node.js 16.13.2 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-44531
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
CVE-2021-44532
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
CVE-2021-44533
Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
CVE-2022-21824
Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Publisher severity

No explicit severity was extracted.

Event: #34810 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:28:41 GMT
Publisher date: Tue, 11 Jan 2022 00:27:39 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

January 10th 2022 Security Releases

Node.js security updates address three medium-severity issues and one low-severity issue across the 12.x, 14.x, 16.x, and 17.x release lines.

Announced 11 Jan 2022

Node.js · Fixed in Node.js v12.22.9 (LTS), Node.js v14.18.3 (LTS), Node.js v16.13.2 (LTS), Node.js v17.3.1 (Current)CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v17.x, v16.x, v14.x, and v12.x Node.js release lines for the following issues.

Node.js

Node.js v12.22.9 (LTS)

Affected versions: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
Fixed versions: Node.js v12.22.9 (LTS)
Node.js v12.22.9 (LTS)
Node.js v14.18.3 (LTS)
Node.js v14.18.3 (LTS)
Node.js v16.13.2 (LTS)
Node.js v16.13.2 (LTS)
Node.js v17.3.1 (Current)
Node.js v17.3.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-44531
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
CVE-2021-44532
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
CVE-2021-44533
Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
CVE-2022-21824
Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Publisher severity

No explicit severity was extracted.

Event: #34787 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:28:23 GMT
Publisher date: Tue, 11 Jan 2022 00:50:00 GMT

Read the original announcement