Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.20.2 (LTS) security release

Node.js 18.20.2 fixes a command injection vulnerability involving child_process.spawn on Windows when the shell option is disabled.

Announced 10 Apr 2024

Node.js · Fixed in 18.20.2 CVE-2024-27980

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Node.js

Node.js 18.20.2 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.20.2
Version 18.20.2 'Hydrogen' (LTS)
Prerequisites: without shell option enabled on Windows
CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Related CVEs: CVE-2024-27980
CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Publisher severity

No explicit severity was extracted.

Event: #24063 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:29:21 GMT
Publisher date: Wed, 10 Apr 2024 16:36:35 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.12.2 (LTS)

This security release addresses command injection on Windows through the args parameter of child_process.spawn when the shell option is disabled.

Announced 10 Apr 2024

Node.js · Fixed in 20.12.2 CVE-2024-27980

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Node.js

Node.js 20.12.2 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.12.2
Version 20.12.2 'Iron' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-27980
CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Publisher severity

No explicit severity was extracted.

Event: #23969 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:27:22 GMT
Publisher date: Wed, 10 Apr 2024 16:38:15 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 21.7.3 (Current)

Node.js 21.7.3 is a security release addressing command injection through the child_process.spawn args parameter on Windows when the shell option is disabled.

Announced 10 Apr 2024

Node.js · Fixed in 21.7.3 CVE-2024-27980

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Node.js

Node.js 21.7.3 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 21.7.3
Version 21.7.3 (Current)
Prerequisites: without shell option enabled on Windows
without shell option enabled on Windows

Related CVEs: CVE-2024-27980
CVE-2024-27980 - Command injection via args parameter of child_process.spawn

Publisher severity

No explicit severity was extracted.

Event: #23968 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:27:19 GMT
Publisher date: Wed, 10 Apr 2024 16:38:50 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js Security Releases

Node.js security updates address five vulnerabilities across the 22.x, 20.x, and 18.x release lines. Downloads listed are Node.js v18.20.4, v20.15.1, and v22.4.1.

Announced 8 Jul 2024

Node.js · Fixed in Node.js v18.20.4, Node.js v20.15.1, Node.js v22.4.1 CVE-2024-27980 CVE-2024-36138 CVE-2024-22020 CVE-2024-36137 CVE-2024-22018 CVE-2024-37372

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for the 22.x, 20.x, 18.x Node.js release lines for the following issues.

Node.js

Node.js v18.20.4

Affected versions: 22.x
Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x
20.x
Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x
18.x
Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x
Fixed versions: Node.js v18.20.4
Node.js v18.20.4
Node.js v20.15.1
Node.js v20.15.1
Node.js v22.4.1
Node.js v22.4.1
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-27980
Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138)
CVE-2024-36138
Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138)
CVE-2024-22020
Bypass network import restriction via data URL (CVE-2024-22020)
CVE-2024-36137
fs.fchown/fchmod bypasses permission model (CVE-2024-36137)
CVE-2024-22018
fs.lstat bypasses permission model (CVE-2024-22018)
CVE-2024-37372
Permission model improperly processes UNC paths (CVE-2024-37372)

Publisher severity

No explicit severity was extracted.

Event: #23139 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:13:27 GMT
Publisher date: Mon, 08 Jul 2024 03:00:00 GMT

Read the original announcement