Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js Security Releases (Update 16-February-2023)

Node.js security releases address OpenSSL updates and multiple vulnerabilities across the 14.x, 16.x, 18.x, and 19.x release lines. Released versions are listed below.

Announced 16 Feb 2023

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues.

Node.js

Node.js v14.21.3 (LTS)

Affected versions: 19.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
18.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
16.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
14.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
Fixed versions: v14.21.3
Node.js v14.21.3 (LTS)
v16.19.1
Node.js v16.19.1 (LTS)
v18.14.1
Node.js v18.14.1 (LTS)
v19.6.1
Node.js v19.6.1 (Current)
Prerequisites: --experimental-policy
This only affects users who had enabled the experimental permissions option with --experimental-policy.

Related CVEs: CVE-2023-23918
Node.js Permissions policies can be bypassed via process.mainModule (High) (CVE-2023-23918)
CVE-2023-23919
Node.js OpenSSL error handling issues in nodejs crypto library (Medium) (CVE-2023-23919)
CVE-2023-23936
Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) (CVE-2023-23936)
CVE-2023-24807
Regular Expression Denial of Service in Headers in Node.js fetch API(Low) (CVE-2023-24807)
CVE-2023-23920
Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) (CVE-2023-23920)

Publisher severity

No explicit severity was extracted.

Event: #29062 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:52:20 GMT
Publisher date: Thu, 16 Feb 2023 21:00:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 14.21.3 (LTS)

Node.js 14.21.3 fixes security vulnerabilities, includes OpenSSL security updates, and updates npm.

Announced 16 Feb 2023

Node.js 14 · Fixed in 14.21.3 CVE-2023-23918 CVE-2023-23920

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js 14

This security release also includes an npm update for Node.js 14

Affected versions: Not stated in this extraction
Fixed versions: 14.21.3
Node.js 14.21.3 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-23918
CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23920
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

Publisher severity

No explicit severity was extracted.

Event: #28975 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:51:21 GMT
Publisher date: Thu, 16 Feb 2023 22:08:13 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 16.19.1 (LTS)

Node.js 16.19.1 (LTS) fixes several security vulnerabilities, including issues in permissions policies, crypto, ICU data loading, and the Fetch API.

Announced 16 Feb 2023

Node.js · Fixed in 16.19.1 CVE-2023-23918 CVE-2023-23919 CVE-2023-23920 CVE-2023-23936 CVE-2023-24807

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 16.19.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 16.19.1
Node.js 16.19.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-23918
CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23920
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
CVE-2023-23936
CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
CVE-2023-24807
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)

Publisher severity

No explicit severity was extracted.

Event: #28880 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:49:37 GMT
Publisher date: Thu, 16 Feb 2023 22:16:31 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 19.6.1 (Current)

Node.js 19.6.1 fixes multiple security vulnerabilities, including three CVEs, and includes OpenSSL security updates.

Announced 16 Feb 2023

Node.js · Fixed in 19.6.1 CVE-2023-23919 CVE-2023-23918 CVE-2023-23920

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release: CVE-2023-23919: OpenSSL errors not cleared in error stack (Medium) CVE-2023-23918: Experimental Policies bypass via process.mainModule.require(High) CVE-2023-23920: Insecure loading of ICU data through ICU_DATA environment variable (Low)

Node.js

Node.js 19.6.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 19.6.1
Node.js 19.6.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-23919
CVE-2023-23919: OpenSSL errors not cleared in error stack (Medium)
CVE-2023-23918
CVE-2023-23918: Experimental Policies bypass via process.mainModule.require(High)
CVE-2023-23920
CVE-2023-23920: Insecure loading of ICU data through ICU_DATA environment variable (Low)

Publisher severity

No explicit severity was extracted.

Event: #28862 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:49:22 GMT
Publisher date: Thu, 16 Feb 2023 22:21:38 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.14.1 (LTS)

Node.js 18.14.1 fixes five listed CVEs and includes OpenSSL security updates.

Announced 16 Feb 2023

Node.js · Fixed in 18.14.1 CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 18.14.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.14.1
Node.js 18.14.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-23918
CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23936
CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
CVE-2023-24807
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
CVE-2023-23920
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

Publisher severity

No explicit severity was extracted.

Event: #28760 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:47:41 GMT
Publisher date: Thu, 16 Feb 2023 22:22:52 GMT

Read the original announcement