Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.19.1 (LTS)

Node.js 18.19.1 is a security release addressing several vulnerabilities, including code injection and privilege escalation, denial of service, and a timing attack. The release explicitly rates some issues High and others Medium.

Announced 14 Feb 2024

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 18.19.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.19.1
Version 18.19.1 'Hydrogen' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-21892
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
CVE-2024-22019
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
CVE-2023-46809
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
CVE-2024-22025
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)

Publisher severity

No explicit severity was extracted.

Event: #24996 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:44:21 GMT
Publisher date: Wed, 14 Feb 2024 17:35:50 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 21.6.2 (Current)

Node.js 21.6.2 is a security release addressing multiple vulnerabilities, including code injection, denial of service, path traversal, privilege escalation, and permission model bypasses.

Announced 14 Feb 2024

Node.js · Fixed in 21.6.2 CVE-2024-21892 CVE-2024-22019 CVE-2024-21896 CVE-2024-22017 CVE-2023-46809 CVE-2024-21891 CVE-2024-21890 CVE-2024-22025

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 21.6.2 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 21.6.2
Version 21.6.2 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-21892
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
CVE-2024-22019
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
CVE-2024-21896
CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
CVE-2024-22017
CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
CVE-2023-46809
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
CVE-2024-21891
CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
CVE-2024-21890
CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
CVE-2024-22025
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)

Publisher severity

No explicit severity was extracted.

Event: #24995 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:44:20 GMT
Publisher date: Wed, 14 Feb 2024 17:36:06 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.11.1 (LTS)

Node.js 20.11.1 is a security release that addresses multiple security issues, including code injection, privilege escalation, denial of service, and permission model bypasses.

Announced 14 Feb 2024

Node.js · Fixed in 20.11.1 CVE-2024-21892 CVE-2024-22019 CVE-2024-21896 CVE-2024-22017 CVE-2023-46809 CVE-2024-21891 CVE-2024-21890 CVE-2024-22025

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.11.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.11.1
Version 20.11.1 'Iron' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-21892
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities
CVE-2024-22019
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
CVE-2024-21896
CVE-2024-21896 - Path traversal by monkey-patching Buffer internals
CVE-2024-22017
CVE-2024-22017 - setuid() does not drop all privileges due to io_uring
CVE-2023-46809
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack
CVE-2024-21891
CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization
CVE-2024-21890
CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write
CVE-2024-22025
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding

Publisher severity

No explicit severity was extracted.

Event: #24814 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:41:22 GMT
Publisher date: Wed, 14 Feb 2024 17:35:59 GMT

Read the original announcement

advisoryUnratedNode.js announcements25 Oct 2026

Beware of End-of-Life Node.js Versions - Upgrade or Seek Post-EOL Support

Node.js 18 and earlier are unsupported and do not receive security patches. The article advises upgrading to a supported Node.js version or obtaining commercial post-EOL support.

Announced 6 Jun 2025

Node.js CVE-2025-23167 CVE-2023-5678 CVE-2024-22019 CVE-2021-39135

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 18 and all earlier versions are End-Of-Life. They are now completely unsupported, meaning they receive no updates, including security patches.

Node.js

Node.js 18 and all earlier versions are End-Of-Life.

Affected versions: 18 and all earlier versions
Node.js 18 and all earlier versions are End-Of-Life.
Fixed versions: Not stated in this extraction
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23167
https://nvd.nist.gov/vuln/detail/CVE-2025-23167 affects 18, 16, 14 (llhttp) - medium
CVE-2023-5678
https://nvd.nist.gov/vuln/detail/CVE-2023-5678 affects 16, 14 (openssl) - medium
CVE-2024-22019
https://nvd.nist.gov/vuln/detail/CVE-2024-22019 affects 16, 14 (llhttp) - high
CVE-2021-39135
https://nvd.nist.gov/vuln/detail/CVE-2021-39135 affects 14 (npm) - high

Publisher severity

No explicit severity was extracted.

Event: #19879 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:18:22 GMT
Publisher date: Fri, 06 Jun 2025 12:00:00 GMT

Read the original announcement