Security feed

25 October 2026

patchHighFix availableNode.js announcements25 Oct 2026

Node.js security releases for July 15, 2025

Node.js released updates addressing two high-severity issues: a Windows path traversal protection bypass and HashDoS in V8.

Announced 15 Jul 2025

Node.js · Fixed in Node.js v20.19.4, Node.js v22.17.1, Node.js v24.4.1 CVE-2025-27210 CVE-2025-27209

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for the 24.x, 22.x, 20.x Node.js release lines for the following issues.

Node.js

The Node.js Project

Affected versions: 20.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
22.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
24.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
Fixed versions: Node.js v20.19.4
Node.js v20.19.4
Node.js v22.17.1
Node.js v22.17.1
Node.js v24.4.1
Node.js v24.4.1
Prerequisites: Windows users of path.join API
This vulnerability affects Windows users of path.join API.

Related CVEs: CVE-2025-27210
(CVE-2025-27210)
CVE-2025-27209
(CVE-2025-27209)

Publisher severity

high

2 high severity issues.

Event: #19355 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 04:53:22 GMT
Publisher date: Tue, 15 Jul 2025 00:00:00 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 24.4.1 (Current)

Node.js 24.4.1 is a security release addressing HashDoS in V8 and a Windows reserved-device-name path traversal protection bypass.

Announced 15 Jul 2025

Node.js · Fixed in 24.4.1 CVE-2025-27209 CVE-2025-27210

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 24.4.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 24.4.1
Node.js 24.4.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-27209
(CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm
CVE-2025-27210
(CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Publisher severity

No explicit severity was extracted.

Event: #19354 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 04:51:21 GMT
Publisher date: Tue, 15 Jul 2025 22:14:44 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 22.17.1 (LTS)

Node.js 22.17.1 is a security release addressing a Windows device-name bypass of path traversal protection in path.normalize().

Announced 15 Jul 2025

Node.js · Fixed in 22.17.1 CVE-2025-27210

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Notable Changes (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Node.js

Node.js 22.17.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 22.17.1
Version 22.17.1 'Jod' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-27210
(CVE-2025-27210)

Publisher severity

No explicit severity was extracted.

Event: #19353 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 04:49:21 GMT
Publisher date: Tue, 15 Jul 2025 22:14:56 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 20.19.4 (LTS)

Node.js 20.19.4 is a security release addressing a path traversal protection bypass involving Windows device names in path.normalize().

Announced 15 Jul 2025

Node.js · Fixed in 20.19.4 CVE-2025-27210

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Notable Changes (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Node.js

Node.js 20.19.4 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.19.4
Node.js 20.19.4 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-27210
(CVE-2025-27210) Windows Device Names

Publisher severity

No explicit severity was extracted.

Event: #19352 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 04:47:21 GMT
Publisher date: Tue, 15 Jul 2025 22:15:06 GMT

Read the original announcement