Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

July 7th 2022 Security Releases

Node.js security releases address multiple vulnerabilities in the 14.x, 16.x, and 18.x release lines. Downloads are listed for Node.js v14.20.0, v16.16.0, and v18.5.0.

Announced 7 Jul 2022

Node.js · Fixed in Node.js v14.20.0 (LTS), Node.js v16.16.0 (LTS), Node.js v18.5.0 (Current)CVE-2022-32213 CVE-2022-32214 CVE-2022-32215 CVE-2022-32212 CVE-2022-32223 CVE-2022-32222 CVE-2022-2097

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.

Node.js

Node.js v14.20.0 (LTS)

Affected versions: All versions of the 18.x, 16.x, and 14.x releases lines
Impacts: All versions of the 18.x, 16.x, and 14.x releases lines.
Fixed versions: Node.js v14.20.0 (LTS)
Node.js v14.20.0 (LTS)
Node.js v16.16.0 (LTS)
Node.js v16.16.0 (LTS)
Node.js v18.5.0 (Current)
Node.js v18.5.0 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2022-32213
HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213)
CVE-2022-32214
HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214)
CVE-2022-32215
HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215)
CVE-2022-32212
DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212)
CVE-2022-32223
DLL Hijacking on Windows (High)(CVE-2022-32223)
CVE-2022-32222
Attempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)(CVE-2022-32222)
CVE-2022-2097
OpenSSL - AES OCB fails to encrypt some bytes (Medium)(CVE-2022-2097)

Publisher severity

No explicit severity was extracted.

Event: #31728 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 08:37:27 GMT
Publisher date: Thu, 07 Jul 2022 16:00:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

September 23rd 2022 Security Releases

Node.js released security updates for the 18.x, 16.x, and 14.x release lines addressing DNS rebinding, HTTP request smuggling, and other vulnerabilities.

Announced 15 Sept 2022

Node.js · Fixed in Node.js v14.20.1 (LTS), Node.js v16.17.1 (LTS), Node.js v18.9.1 (Current)CVE-2022-32212 CVE-2018-7160 CVE-2022-32213 CVE-2022-35256 CVE-2022-32222 CVE-2022-35255

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.

Node.js

Node.js v14.20.1 (LTS)

Affected versions: All versions of the 18.x, 16.x, and 14.x release lines
Impacts: All versions of the 18.x, 16.x, and 14.x release lines.
Fixed versions: Node.js v14.20.1 (LTS)
Node.js v14.20.1 (LTS)
Node.js v16.17.1 (LTS)
Node.js v16.17.1 (LTS)
Node.js v18.9.1 (Current)
Node.js v18.9.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2022-32212
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
CVE-2018-7160
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) (High) (CVE-2022-32212, CVE-2018-7160)
CVE-2022-32213
CVE-2022-32213 bypass via obs-fold mechanic (Medium) (CVE-2022-32213)
CVE-2022-35256
HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) (CVE-2022-35256)
CVE-2022-32222
Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on macOS (Medium) (CVE-2022-32222)
CVE-2022-35255
Weak randomness in WebCrypto keygen (High) (CVE-2022-35255)

Publisher severity

No explicit severity was extracted.

Event: #31124 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 08:27:25 GMT
Publisher date: Thu, 15 Sep 2022 16:00:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 14.20.1 (LTS)

Node.js 14.20.1 fixes three listed CVEs, including DNS rebinding in --inspect on macOS and HTTP request smuggling.

Announced 23 Sept 2022

Node.js · Fixed in 14.20.1 CVE-2022-32212 CVE-2022-32213 CVE-2022-35256

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 14.20.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 14.20.1
Node.js 14.20.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2022-32212
CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
CVE-2022-32213
CVE-2022-32213: bypass via obs-fold mechanic (Medium)
CVE-2022-35256
CVE-2022-35256: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium)

Publisher severity

No explicit severity was extracted.

Event: #30913 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 08:23:35 GMT
Publisher date: Fri, 23 Sep 2022 16:13:35 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.9.1 (Current)

Node.js 18.9.1 fixes multiple security vulnerabilities, including DNS rebinding, OpenSSL configuration file handling, HTTP request smuggling, and weak randomness in WebCrypto key generation.

Announced 23 Sept 2022

Node.js · Fixed in 18.9.1 CVE-2022-32212 CVE-2022-32222 CVE-2022-32213 CVE-2022-32215 CVE-2022-35256 CVE-2022-35255

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 18.9.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 18.9.1
Node.js 18.9.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2022-32212
CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
CVE-2022-32222
CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
CVE-2022-32213
CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
CVE-2022-32215
CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
CVE-2022-35256
CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
CVE-2022-35255
CVE-2022-35255: Weak randomness in WebCrypto keygen

Publisher severity

No explicit severity was extracted.

Event: #30896 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 08:23:22 GMT
Publisher date: Fri, 23 Sep 2022 16:14:04 GMT

Read the original announcement