Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js security releases

Security updates address multiple vulnerabilities in Node.js 16.x, 18.x and 20.x, including issues involving experimental policy and permission mechanisms. Updates are available in Node.js v16.20.2, v18.17.1 and v20.5.1.

Announced 9 Aug 2023

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues.

Node.js

Node.js v16.20.2 (LTS)

Affected versions: 16.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
18.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
20.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Fixed versions: v16.20.2
Node.js v16.20.2 (LTS)
v18.17.1
Node.js v18.17.1 (LTS)
v20.5.1
Node.js v20.5.1 (Current)
Prerequisites: using the experimental policy mechanism
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
using the experimental permission model
This vulnerability affects all users using the experimental permission model in Node.js 20.

Related CVEs: CVE-2023-32002
Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002)
CVE-2023-32004
Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004)
CVE-2023-32558
process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558)
CVE-2023-32006
Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006)
CVE-2023-32559
Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559)
CVE-2023-32005
fs.statfs can retrieve stats from files restricted by the Permission Model (LOW)(CVE-2023-32005)
CVE-2023-32003
fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003)

Publisher severity

No explicit severity was extracted.

Event: #27448 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:25:43 GMT
Publisher date: Wed, 09 Aug 2023 14:30:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 16.20.2 (LTS)

Node.js 16.20.2 fixes three policy-bypass vulnerabilities and includes OpenSSL security updates.

Announced 9 Aug 2023

Node.js · Fixed in 16.20.2 CVE-2023-32002 CVE-2023-32006 CVE-2023-32559

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release: CVE-2023-32002: Policies can be bypassed via Module._load

Node.js

Node.js 16.20.2 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 16.20.2
Node.js 16.20.2 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-32002
CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32006
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)

Publisher severity

No explicit severity was extracted.

Event: #27207 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:21:21 GMT
Publisher date: Wed, 09 Aug 2023 16:51:54 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.17.1 (LTS)

Node.js 18.17.1 fixes three policy-bypass vulnerabilities and includes OpenSSL security updates.

Announced 9 Aug 2023

Node.js · Fixed in 18.17.1 CVE-2023-32002 CVE-2023-32006 CVE-2023-32559

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release: CVE-2023-32002: Policies can be bypassed via Module._load (High)

Node.js

Node.js 18.17.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.17.1
Node.js 18.17.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-32002
CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32006
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)

Publisher severity

No explicit severity was extracted.

Event: #27206 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:21:21 GMT
Publisher date: Wed, 09 Aug 2023 17:09:37 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.5.1 (Current)

Node.js 20.5.1 fixes multiple policy and permission-model bypass vulnerabilities, including issues rated High, Medium, and Low.

Announced 9 Aug 2023

Node.js · Fixed in 20.5.1 CVE-2023-32002 CVE-2023-32558 CVE-2023-32004 CVE-2023-32006 CVE-2023-32559 CVE-2023-32005 CVE-2023-32003

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 20.5.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 20.5.1
Node.js 20.5.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2023-32002
CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32558
CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High)
CVE-2023-32004
CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High)
CVE-2023-32006
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
CVE-2023-32005
CVE-2023-32005: fs.statfs can bypass the permission model (Low)
CVE-2023-32003
CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low)

Publisher severity

No explicit severity was extracted.

Event: #27124 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:20:22 GMT
Publisher date: Wed, 09 Aug 2023 17:55:32 GMT

Read the original announcement