July 7th 2022 Security Releases
Node.js security releases address multiple vulnerabilities in the 14.x, 16.x, and 18.x release lines. Downloads are listed for Node.js v14.20.0, v16.16.0, and v18.5.0.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.
Node.js
Node.js v14.20.0 (LTS)
- Affected versions
- All versions of the 18.x, 16.x, and 14.x releases lines
Impacts: All versions of the 18.x, 16.x, and 14.x releases lines.
- Fixed versions
- Node.js v14.20.0 (LTS)
Node.js v14.20.0 (LTS)
Node.js v16.16.0 (LTS)Node.js v16.16.0 (LTS)
Node.js v18.5.0 (Current)Node.js v18.5.0 (Current)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2022-32213
HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213)
CVE-2022-32214HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214)
CVE-2022-32215HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215)
CVE-2022-32212DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212)
CVE-2022-32223DLL Hijacking on Windows (High)(CVE-2022-32223)
CVE-2022-32222Attempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)(CVE-2022-32222)
CVE-2022-2097OpenSSL - AES OCB fails to encrypt some bytes (Medium)(CVE-2022-2097)
Publisher severity
No explicit severity was extracted.