Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js security releases for June 20, 2023

Security updates address vulnerabilities in Node.js and bundled OpenSSL and c-ares components. Updated releases are Node.js v16.20.1, v18.16.1, and v20.3.1.

Announced 20 Jun 2023

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for all supported Node.js release lines for the following issues.

Node.js

Node.js v16.20.1 (LTS)

Affected versions: 16.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
18.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
20.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Fixed versions: Node.js v16.20.1
Node.js v16.20.1 (LTS)
Node.js v18.16.1
Node.js v18.16.1 (LTS)
Node.js v20.3.1
Node.js v20.3.1 (Current)
Prerequisites: using the experimental policy mechanism
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
using the experimental permission model
This vulnerability affects all users using the experimental permission model in Node.js 20.

Related CVEs: CVE-2023-30581
mainModule.proto bypass experimental policy mechanism (High) (CVE-2023-30581)
CVE-2023-30584
Path traversal bypass in experimental permission model (High) (CVE-2023-30584)
CVE-2023-30587
Inspector protocol bypass the experimental permission model (High) (CVE-2023-30587)
CVE-2023-30582
fs.watchFile bypass in experimental permission model (Medium) (CVE-2023-30582)
CVE-2023-30583
fs.openAsBlob bypass in experimental permission model (Medium) (CVE-2023-30583)
CVE-2023-30585
Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) (CVE-2023-30585)
CVE-2023-30586
OpenSSL engines can be used to bypass the permission model (Medium) (CVE-2023-30586)
CVE-2023-30588
Process interruption due to invalid Public Key information in x509 certificates (Medium) (CVE-2023-30588)
CVE-2023-30589
HTTP Request Smuggling via Empty headers separated by CR (Medium) (CVE-2023-30589)
CVE-2023-30590
DiffieHellman do not generate keys after setting a private key (Medium) (CVE-2023-30590)

Publisher severity

No explicit severity was extracted.

Event: #28023 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:35:25 GMT
Publisher date: Tue, 20 Jun 2023 14:30:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 16.20.1 (LTS)

Node.js 16.20.1 fixes multiple listed vulnerabilities, including issues in policy handling, the Windows installer, HTTP headers, and cryptographic operations.

Announced 20 Jun 2023

Node.js · Fixed in 16.20.1 CVE-2023-30581 CVE-2023-30585 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 16.20.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 16.20.1
Node.js 16.20.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-30581
CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30585
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30588
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)

Publisher severity

No explicit severity was extracted.

Event: #27685 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:29:35 GMT
Publisher date: Tue, 20 Jun 2023 19:27:28 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.3.1 (Current)

Node.js 20.3.1 fixes multiple security vulnerabilities, including issues in the experimental policy and permission mechanisms, installer repair, and HTTP request handling.

Announced 20 Jun 2023

Node.js · Fixed in 20.3.1 CVE-2023-30581 CVE-2023-30584 CVE-2023-30587 CVE-2023-30582 CVE-2023-30583 CVE-2023-30585 CVE-2023-30586 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 20.3.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 20.3.1
Node.js 20.3.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-30581
CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30584
CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High)
CVE-2023-30587
CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High)
CVE-2023-30582
CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium)
CVE-2023-30583
CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium)
CVE-2023-30585
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30586
CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium)
CVE-2023-30588
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)

Publisher severity

No explicit severity was extracted.

Event: #27670 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:29:23 GMT
Publisher date: Tue, 20 Jun 2023 20:13:40 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.16.1 (LTS)

Node.js 18.16.1 fixes multiple security vulnerabilities, including issues involving policy bypass, installer repair, HTTP request smuggling, and certificate handling.

Announced 20 Jun 2023

Node.js · Fixed in 18.16.1 CVE-2023-30581 CVE-2023-30585 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 18.16.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.16.1
Node.js 18.16.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-30581
CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30585
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30588
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)

Publisher severity

No explicit severity was extracted.

Event: #27543 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:27:22 GMT
Publisher date: Tue, 20 Jun 2023 20:33:42 GMT

Read the original announcement