Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js security releases for November 2022

Node.js security updates address three vulnerabilities, including OpenSSL certificate buffer overflows and DNS rebinding through --inspect. Updates are available in the listed release versions.

Announced 1 Nov 2022

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for v14,x, v16.x, v18.x and v19.x Node.js release lines for the following issues.

Node.js

Node.js v14.21.1 (LTS)

Affected versions: All versions of the v14.x, v16.x, v18.x, and v19.x releases lines
Impacts: All versions of the v14.x, v16.x, v18.x, and v19.x releases lines.
Fixed versions: v14.21.1
Node.js v14.21.1 (LTS)
v16.18.1
Node.js v16.18.1 (LTS)
v18.12.1
Node.js v18.12.1 (LTS)
v19.0.1
Node.js v19.0.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2022-3602
X.509 Email Address 4-byte Buffer Overflow (High) (CVE-2022-3602)
CVE-2022-3786
X.509 Email Address Variable Length Buffer Overflow (High) (CVE-2022-3786)
CVE-2022-43548
DNS rebinding in --inspect via invalid octal IP address (Medium) (CVE-2022-43548)

Publisher severity

No explicit severity was extracted.

Event: #30005 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 08:08:22 GMT
Publisher date: Tue, 01 Nov 2022 21:00:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.12.1 (LTS)

Node.js 18.12.1 fixes three reported vulnerabilities, including X.509 buffer overflows and DNS rebinding through --inspect.

Announced 4 Nov 2022

Node.js · Fixed in 18.12.1 CVE-2022-3602 CVE-2022-3786 CVE-2022-43548

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release: CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

Node.js

Node.js 18.12.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.12.1
Node.js 18.12.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2022-3602
CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High)
CVE-2022-3786
CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High)
CVE-2022-43548
CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

Publisher severity

No explicit severity was extracted.

Event: #29781 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 08:04:32 GMT
Publisher date: Fri, 04 Nov 2022 22:34:29 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 19.0.1 (Current)

Node.js 19.0.1 fixes three listed vulnerabilities, including two rated High and one rated Medium.

Announced 4 Nov 2022

Node.js · Fixed in 19.0.1 CVE-2022-3602 CVE-2022-3786 CVE-2022-43548

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release: CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High) CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High) CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

Node.js

Node.js 19.0.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 19.0.1
Node.js 19.0.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2022-3602
CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High)
CVE-2022-3786
CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High)
CVE-2022-43548
CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

Publisher severity

No explicit severity was extracted.

Event: #29776 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 08:04:26 GMT
Publisher date: Fri, 04 Nov 2022 18:05:19 GMT

Read the original announcement