Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js security releases available

Node.js security updates address three vulnerabilities affecting supported release lines. Updated releases include Node.js v20.19.2, v22.15.1, v23.11.1, and v24.0.2.

Announced 14 May 2025

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the 24.x, 23.x, 22.x, 20.x Node.js release lines for the following issues.

Node.js

Node.js v20.19.2

Affected versions: 20.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
22.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
23.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
24.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
Fixed versions: Node.js v20.19.2
Node.js v20.19.2
Node.js v22.15.1
Node.js v22.15.1
Node.js v23.11.1
Node.js v23.11.1
Node.js v24.0.2
Node.js v24.0.2
Prerequisites: Not stated in this extraction

Node.js

A flaw in Node.js 20's HTTP parser

Affected versions: Node.js 20.x users prior to the llhttp v9 upgrade
This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Fixed versions: llhttp to version 9
The issue was resolved by upgrading llhttp to version 9
Prerequisites: Not stated in this extraction

Node.js

In Node.js, the ReadFileUtf8 internal binding

Affected versions: v20 and v22
This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22.
Fixed versions: Node.js v20.19.2
Node.js v20.19.2
Node.js v22.15.1
Node.js v22.15.1
Prerequisites: Windows systems relying on the ReadFileUtf8 API
This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22.

Related CVEs: CVE-2025-23166
Improper error handling in async cryptographic operations crashes process (CVE-2025-23166)
CVE-2025-23167
Improper HTTP header block termination in llhttp (CVE-2025-23167)
CVE-2025-23165
Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165)

Publisher severity

No explicit severity was extracted.

Event: #19567 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:12:39 GMT
Publisher date: Wed, 14 May 2025 03:00:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.19.2 (LTS)

Node.js 20.19.2 is a security release that fixes issues in async crypto error handling and filesystem request cleanup, and updates llhttp.

Announced 14 May 2025

Node.js · Fixed in 20.19.2 CVE-2025-23166 CVE-2025-23167 CVE-2025-23165 CVE-2024-27982

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.19.2 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.19.2
Version 20.19.2 'Iron' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23166
(CVE-2025-23166) fix error handling on async crypto operation
CVE-2025-23167
(CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
CVE-2025-23165
(CVE-2025-23165) add missing call to uv_fs_req_cleanup
CVE-2024-27982
(CVE-2024-27982) http: do not allow OBS fold in headers by default

Publisher severity

No explicit severity was extracted.

Event: #19550 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:12:23 GMT
Publisher date: Wed, 14 May 2025 21:14:45 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 23.11.1 (Current)

Node.js 23.11.1 is a security release that fixes error handling on asynchronous crypto operations.

Announced 14 May 2025

Node.js · Fixed in 23.11.1 CVE-2025-23166

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Notable Changes src: (CVE-2025-23166) fix error handling on async crypto operation

Node.js

Node.js 23.11.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 23.11.1
Version 23.11.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23166
(CVE-2025-23166) src: fix error handling on async crypto operations

Publisher severity

No explicit severity was extracted.

Event: #19445 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:10:22 GMT
Publisher date: Wed, 14 May 2025 21:16:29 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 22.15.1 (LTS)

Node.js 22.15.1 is a security release that fixes error handling for asynchronous crypto operations and adds a missing filesystem request cleanup call.

Announced 14 May 2025

Node.js · Fixed in 22.15.1 CVE-2025-23166 CVE-2025-23165

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 22.15.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 22.15.1
Version 22.15.1 'Jod' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23166
(CVE-2025-23166) fix error handling on async crypto operation
CVE-2025-23165
(CVE-2025-23165) add missing call to uv_fs_req_cleanup

Publisher severity

No explicit severity was extracted.

Event: #19357 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:08:21 GMT
Publisher date: Wed, 14 May 2025 21:15:50 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 24.0.2 (Current)

Node.js 24.0.2 is a security release that fixes error handling on asynchronous crypto operations.

Announced 14 May 2025

Node.js · Fixed in 24.0.2 CVE-2025-23166

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Notable Changes (CVE-2025-23166) fix error handling on async crypto operation

Node.js

Node.js 24.0.2 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 24.0.2
Version 24.0.2 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23166
Notable Changes (CVE-2025-23166)

Publisher severity

No explicit severity was extracted.

Event: #19356 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:07:21 GMT
Publisher date: Wed, 14 May 2025 21:17:11 GMT

Read the original announcement