Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js Security Releases — April 3, 2024

Node.js security releases address two vulnerabilities in the 18.x, 20.x, and 21.x release lines, including an HTTP/2 server crash and HTTP request smuggling. The release also updates llhttp and undici dependencies.

Announced 3 Apr 2024

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.

Node.js

The Node.js Project

Affected versions: 18.x
The 18.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
20.x
The 20.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
21.x
The 21.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
Fixed versions: 18.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
20.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
21.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
Prerequisites: Not stated in this extraction

llhttp

llhttp version 9.2.1 on 21.x, 20.x, and 18.x

Affected versions: Not stated in this extraction
Fixed versions: 9.2.1
llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Prerequisites: Not stated in this extraction

undici

undici version 6.11.1 on 21.x

Affected versions: Not stated in this extraction
Fixed versions: 6.11.1
undici version 6.11.1 on 21.x
5.28.4
undici version 5.28.4 on 18.x and 20.x
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-27983
Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983)
CVE-2024-27982
HTTP Request Smuggling via Content Length Obfuscation - (CVE-2024-27982)

Publisher severity

No explicit severity was extracted.

Event: #24633 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:38:36 GMT
Publisher date: Wed, 03 Apr 2024 03:00:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.12.1 (LTS)

Node.js 20.12.1 is a security release addressing HTTP/2 server crashes and HTTP request smuggling.

Announced 3 Apr 2024

Node.js · Fixed in 20.12.1 CVE-2024-27983 CVE-2024-27982

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release

Node.js

Node.js 20.12.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.12.1
Version 20.12.1 'Iron' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-27983
CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
CVE-2024-27982
CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)

Publisher severity

No explicit severity was extracted.

Event: #24332 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:33:34 GMT
Publisher date: Wed, 03 Apr 2024 14:16:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 21.7.2 (Current)

Node.js 21.7.2 is a security release addressing HTTP/2 server crashes and HTTP request smuggling.

Announced 3 Apr 2024

Node.js · Fixed in 21.7.2 CVE-2024-27983 CVE-2024-27982

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 21.7.2 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 21.7.2
Version 21.7.2 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-27983
CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
CVE-2024-27982
CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation- (Medium)

Publisher severity

No explicit severity was extracted.

Event: #24219 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:31:45 GMT
Publisher date: Wed, 03 Apr 2024 14:18:52 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.20.1 (LTS)

Node.js 18.20.1 is a security release addressing an HTTP/2 server crash and HTTP request smuggling. The release identifies both issues as security fixes, but does not specify affected version ranges.

Announced 3 Apr 2024

Node.js · Fixed in 18.20.1 CVE-2024-27983 CVE-2024-27982

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 18.20.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.20.1
Version 18.20.1 'Hydrogen' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-27983
CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
CVE-2024-27982
CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)

Publisher severity

No explicit severity was extracted.

Event: #24195 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:31:26 GMT
Publisher date: Wed, 03 Apr 2024 14:27:39 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.19.2 (LTS)

Node.js 20.19.2 is a security release that fixes issues in async crypto error handling and filesystem request cleanup, and updates llhttp.

Announced 14 May 2025

Node.js · Fixed in 20.19.2 CVE-2025-23166 CVE-2025-23167 CVE-2025-23165 CVE-2024-27982

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.19.2 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.19.2
Version 20.19.2 'Iron' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23166
(CVE-2025-23166) fix error handling on async crypto operation
CVE-2025-23167
(CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
CVE-2025-23165
(CVE-2025-23165) add missing call to uv_fs_req_cleanup
CVE-2024-27982
(CVE-2024-27982) http: do not allow OBS fold in headers by default

Publisher severity

No explicit severity was extracted.

Event: #19550 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:12:23 GMT
Publisher date: Wed, 14 May 2025 21:14:45 GMT

Read the original announcement