Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 20.18.2 (LTS) security release

Node.js 20.18.2 (LTS) addresses multiple security issues, including flaws involving InternalWorker use, HTTP/2, Windows path normalization, and undici fetch().

Announced

Node.js · Fixed in 20.18.2CVE-2025-23083CVE-2025-23085CVE-2025-23084CVE-2025-22150
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.18.2 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
20.18.2
Version 20.18.2 'Iron' (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2025-23083
CVE-2025-23083 - throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event
#21055 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 22.13.1 (LTS)

Node.js 22.13.1 is a security release addressing multiple vulnerabilities, including issues involving the permission model, HTTP/2, Windows path normalization, and undici fetch().

Announced

Node.js · Fixed in 22.13.1CVE-2025-23083CVE-2025-23085CVE-2025-23084CVE-2025-22150
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 22.13.1 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
22.13.1
Version 22.13.1 'Jod' (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2025-23083
CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event
#20948 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 23.6.1 security release

Node.js 23.6.1 addresses security issues involving InternalWorker use with the permission model, HTTP/2 memory leakage, Windows path traversal, and insufficiently random values in undici fetch().

Announced

Node.js · Fixed in 23.6.1CVE-2025-23083CVE-2025-23085CVE-2025-23084CVE-2025-22150
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 23.6.1 (Current)
Affected versions
Not stated in this extraction
Fixed versions
23.6.1
Version 23.6.1 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2025-23083
CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event
#20939 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement