Security feed

patchHighFix availableNode.js announcements25 Oct 2026

Node.js released updates addressing two high-severity issues: a Windows path traversal protection bypass and HashDoS in V8.

Announced 15 Jul 2025

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security releases available Updates are now available for the 24.x, 22.x, 20.x Node.js release lines for the following issues.

The Node.js Project

Affected versions: 20.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
22.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
24.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
Fixed versions: Node.js v20.19.4
Node.js v20.19.4
Node.js v22.17.1
Node.js v22.17.1
Node.js v24.4.1
Node.js v24.4.1
Prerequisites: Windows users of path.join API
This vulnerability affects Windows users of path.join API.

Related CVEs: CVE-2025-27210
(CVE-2025-27210)
CVE-2025-27209
(CVE-2025-27209)

high

2 high severity issues.

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 24.4.1 is a security release addressing HashDoS in V8 and a Windows reserved-device-name path traversal protection bypass.

Announced 15 Jul 2025

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

This is a security release.

Node.js 24.4.1 (Current)

Related CVEs: CVE-2025-27209
(CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm
CVE-2025-27210
(CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

No explicit severity was extracted.

25 October 2026