Heist/ feed

Security feed

advisoryUnratedNode.js announcements

Beware of End-of-Life Node.js Versions - Upgrade or Seek Post-EOL Support

Node.js 18 and earlier are unsupported and do not receive security patches. The article advises upgrading to a supported Node.js version or obtaining commercial post-EOL support.

Announced

Node.jsCVE-2025-23167CVE-2023-5678CVE-2024-22019CVE-2021-39135
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 18 and all earlier versions are End-Of-Life. They are now completely unsupported, meaning they receive no updates, including security patches.

Node.js

Node.js 18 and all earlier versions are End-Of-Life.
Affected versions
18 and all earlier versions
Node.js 18 and all earlier versions are End-Of-Life.
Fixed versions
Not stated in this extraction
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2025-23167
https://nvd.nist.gov/vuln/detail/CVE-2025-23167 affects 18, 16, 14 (llhttp) - medium
CVE-2023-5678
https://nvd.nist.gov/vuln/detail/CVE-2023-5678 affects 16, 14 (openssl) - medium
CVE-2024-22019
https://nvd.nist.gov/vuln/detail/CVE-2024-22019 affects 16, 14 (llhttp) - high
CVE-2021-39135
https://nvd.nist.gov/vuln/detail/CVE-2021-39135 affects 14 (npm) - high

Publisher severity

No explicit severity was extracted.

Event
#19879 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js security releases available

Node.js security updates address three vulnerabilities affecting supported release lines. Updated releases include Node.js v20.19.2, v22.15.1, v23.11.1, and v24.0.2.

Announced

Node.js · Fixed in Node.js v20.19.2, Node.js v22.15.1, Node.js v23.11.1, Node.js v24.0.2Node.js · Fixed in llhttp to version 9Node.js · Fixed in Node.js v20.19.2, Node.js v22.15.1CVE-2025-23166CVE-2025-23167CVE-2025-23165
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the 24.x, 23.x, 22.x, 20.x Node.js release lines for the following issues.

Node.js

Node.js v20.19.2
Affected versions
20.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
22.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
23.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
24.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
Fixed versions
Node.js v20.19.2
Node.js v20.19.2
Node.js v22.15.1
Node.js v22.15.1
Node.js v23.11.1
Node.js v23.11.1
Node.js v24.0.2
Node.js v24.0.2
Prerequisites
Not stated in this extraction

Node.js

A flaw in Node.js 20's HTTP parser
Affected versions
Node.js 20.x users prior to the llhttp v9 upgrade
This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Fixed versions
llhttp to version 9
The issue was resolved by upgrading llhttp to version 9
Prerequisites
Not stated in this extraction

Node.js

In Node.js, the ReadFileUtf8 internal binding
Affected versions
v20 and v22
This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22.
Fixed versions
Node.js v20.19.2
Node.js v20.19.2
Node.js v22.15.1
Node.js v22.15.1
Prerequisites
Windows systems relying on the ReadFileUtf8 API
This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22.
Related CVEs
CVE-2025-23166
Improper error handling in async cryptographic operations crashes process (CVE-2025-23166)
CVE-2025-23167
Improper HTTP header block termination in llhttp (CVE-2025-23167)
CVE-2025-23165
Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165)

Publisher severity

No explicit severity was extracted.

Event
#19567 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 20.19.2 (LTS)

Node.js 20.19.2 is a security release that fixes issues in async crypto error handling and filesystem request cleanup, and updates llhttp.

Announced

Node.js · Fixed in 20.19.2CVE-2025-23166CVE-2025-23167CVE-2025-23165CVE-2024-27982
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.19.2 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
20.19.2
Version 20.19.2 'Iron' (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2025-23166
(CVE-2025-23166) fix error handling on async crypto operation
CVE-2025-23167
(CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
CVE-2025-23165
(CVE-2025-23165) add missing call to uv_fs_req_cleanup
CVE-2024-27982
(CVE-2024-27982) http: do not allow OBS fold in headers by default

Publisher severity

No explicit severity was extracted.

Event
#19550 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement