Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 18.20.6 (LTS)

Node.js 18.20.6 is a security release fixing HTTP/2 memory leakage and Windows path traversal issues, and updating undici to address insufficiently random values in fetch().

Announced 21 Jan 2025

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 18.20.6 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 18.20.6
Version 18.20.6 'Hydrogen' (LTS)
Prerequisites: Not stated in this extraction

undici

Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Affected versions: Not stated in this extraction
Fixed versions: v5.28.5
deps: update undici to v5.28.5
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event: #21250 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:41:20 GMT
Publisher date: Tue, 21 Jan 2025 17:05:27 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.18.2 (LTS) security release

Node.js 20.18.2 (LTS) addresses multiple security issues, including flaws involving InternalWorker use, HTTP/2, Windows path normalization, and undici fetch().

Announced 21 Jan 2025

Node.js · Fixed in 20.18.2 CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2025-22150

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.18.2 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.18.2
Version 20.18.2 'Iron' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23083
CVE-2025-23083 - throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event: #21055 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:38:23 GMT
Publisher date: Tue, 21 Jan 2025 17:05:40 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 22.13.1 (LTS)

Node.js 22.13.1 is a security release addressing multiple vulnerabilities, including issues involving the permission model, HTTP/2, Windows path normalization, and undici fetch().

Announced 21 Jan 2025

Node.js · Fixed in 22.13.1 CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2025-22150

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 22.13.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 22.13.1
Version 22.13.1 'Jod' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23083
CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event: #20948 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:36:33 GMT
Publisher date: Tue, 21 Jan 2025 17:05:48 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 23.6.1 security release

Node.js 23.6.1 addresses security issues involving InternalWorker use with the permission model, HTTP/2 memory leakage, Windows path traversal, and insufficiently random values in undici fetch().

Announced 21 Jan 2025

Node.js · Fixed in 23.6.1 CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2025-22150

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 23.6.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 23.6.1
Version 23.6.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23083
CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event: #20939 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:36:25 GMT
Publisher date: Tue, 21 Jan 2025 17:06:07 GMT

Read the original announcement