Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js Security Releases

Node.js security updates address five vulnerabilities across the 22.x, 20.x, and 18.x release lines. Downloads listed are Node.js v18.20.4, v20.15.1, and v22.4.1.

Announced 8 Jul 2024

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for the 22.x, 20.x, 18.x Node.js release lines for the following issues.

Node.js

Node.js v18.20.4

Affected versions: 22.x
Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x
20.x
Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x
18.x
Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x
Fixed versions: Node.js v18.20.4
Node.js v18.20.4
Node.js v20.15.1
Node.js v20.15.1
Node.js v22.4.1
Node.js v22.4.1
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-27980
Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138)
CVE-2024-36138
Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138)
CVE-2024-22020
Bypass network import restriction via data URL (CVE-2024-22020)
CVE-2024-36137
fs.fchown/fchmod bypasses permission model (CVE-2024-36137)
CVE-2024-22018
fs.lstat bypasses permission model (CVE-2024-22018)
CVE-2024-37372
Permission model improperly processes UNC paths (CVE-2024-37372)

Publisher severity

No explicit severity was extracted.

Event: #23139 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:13:27 GMT
Publisher date: Mon, 08 Jul 2024 03:00:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.20.4 (LTS)

Node.js 18.20.4 is a security release that addresses two listed vulnerabilities.

Announced 8 Jul 2024

Node.js · Fixed in 18.20.4 CVE-2024-36138 CVE-2024-22020

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 18.20.4 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.20.4
Version 18.20.4 'Hydrogen' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-36138
CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
CVE-2024-22020
CVE-2024-22020 - Bypass network import restriction via data URL (Medium)

Publisher severity

No explicit severity was extracted.

Event: #23032 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:11:22 GMT
Publisher date: Mon, 08 Jul 2024 18:15:09 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 22.4.1 (Current)

Node.js 22.4.1 is a security release addressing multiple vulnerabilities, including permission-model bypasses and a network-import restriction bypass.

Announced 9 Jul 2024

Node.js · Fixed in 22.4.1 CVE-2024-36138 CVE-2024-22020 CVE-2024-22018 CVE-2024-36137 CVE-2024-37372

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 22.4.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 22.4.1
Version 22.4.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-36138
CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
CVE-2024-22020
CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
CVE-2024-22018
CVE-2024-22018 - fs.lstat bypasses permission model (Low)
CVE-2024-36137
CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
CVE-2024-37372
CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

Publisher severity

No explicit severity was extracted.

Event: #23031 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:11:22 GMT
Publisher date: Tue, 09 Jul 2024 02:31:49 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.15.1 (LTS)

Node.js 20.15.1 is a security release addressing several vulnerabilities involving network import restrictions and the permission model.

Announced 8 Jul 2024

Node.js · Fixed in 20.15.1 CVE-2024-36138 CVE-2024-22020 CVE-2024-22018 CVE-2024-36137 CVE-2024-37372

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.15.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.15.1
Version 20.15.1 'Iron' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2024-36138
CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
CVE-2024-22020
CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
CVE-2024-22018
CVE-2024-22018 - fs.lstat bypasses permission model (Low)
CVE-2024-36137
CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
CVE-2024-37372
CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

Publisher severity

No explicit severity was extracted.

Event: #22944 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:10:22 GMT
Publisher date: Mon, 08 Jul 2024 18:16:32 GMT

Read the original announcement