Node.js Security Releases (Update 16-February-2023)
Node.js security releases address OpenSSL updates and multiple vulnerabilities across the 14.x, 16.x, 18.x, and 19.x release lines. Released versions are listed below.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues.
Node.js
Node.js v14.21.3 (LTS)
- Affected versions
- 19.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
18.xAll versions of the 19.x, 18.x, 16.x, and 14.x release lines.
16.xAll versions of the 19.x, 18.x, 16.x, and 14.x release lines.
14.xAll versions of the 19.x, 18.x, 16.x, and 14.x release lines.
- Fixed versions
- v14.21.3
Node.js v14.21.3 (LTS)
v16.19.1Node.js v16.19.1 (LTS)
v18.14.1Node.js v18.14.1 (LTS)
v19.6.1Node.js v19.6.1 (Current)
- Prerequisites
- --experimental-policy
This only affects users who had enabled the experimental permissions option with --experimental-policy.
- Related CVEs
- CVE-2023-23918
Node.js Permissions policies can be bypassed via process.mainModule (High) (CVE-2023-23918)
CVE-2023-23919Node.js OpenSSL error handling issues in nodejs crypto library (Medium) (CVE-2023-23919)
CVE-2023-23936Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) (CVE-2023-23936)
CVE-2023-24807Regular Expression Denial of Service in Headers in Node.js fetch API(Low) (CVE-2023-24807)
CVE-2023-23920Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) (CVE-2023-23920)
Publisher severity
No explicit severity was extracted.