Node.js 18.20.6 (LTS)
Node.js 18.20.6 is a security release fixing HTTP/2 memory leakage and Windows path traversal issues, and updating undici to address insufficiently random values in fetch().
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release.
Node.js
Node.js 18.20.6 (LTS)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 18.20.6
Version 18.20.6 'Hydrogen' (LTS)
- Prerequisites
- Not stated in this extraction
undici
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
- Affected versions
- Not stated in this extraction
- Fixed versions
- v5.28.5
deps: update undici to v5.28.5
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Publisher severity
No explicit severity was extracted.