Updates on CVE for End-of-Life Versions
The CVE Program rejected CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089, which had been issued to identify end-of-life Node.js versions. The Node.js project says it will instead update previous vulnerability-specific CVEs to include EOL releases unless it has information showing a CVE does not apply.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to tag EOL versions have been rejected by the CVE Program. The Node.js team has, therefore, decided to update previous vulnerability specific CVEs to cover EOL releases
Node.js
Node.js released security patches for four active release lines
- Affected versions
- Not stated in this extraction
- Fixed versions
- Not stated in this extraction
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2025-23087
CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to tag EOL versions have been rejected by the CVE Program.
CVE-2025-23088CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to tag EOL versions have been rejected by the CVE Program.
CVE-2025-23089CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to tag EOL versions have been rejected by the CVE Program.
Publisher severity
No explicit severity was extracted.