Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js Security Releases — April 3, 2024

Node.js security releases address two vulnerabilities in the 18.x, 20.x, and 21.x release lines, including an HTTP/2 server crash and HTTP request smuggling. The release also updates llhttp and undici dependencies.

Announced

Node.js · Fixed in 18.x, 20.x, 21.xllhttp · Fixed in 9.2.1undici · Fixed in 6.11.1, 5.28.4CVE-2024-27983CVE-2024-27982
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.

Node.js

The Node.js Project
Affected versions
18.x
The 18.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
20.x
The 20.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
21.x
The 21.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.
Fixed versions
18.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
20.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
21.x
Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.
Prerequisites
Not stated in this extraction

llhttp

llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Affected versions
Not stated in this extraction
Fixed versions
9.2.1
llhttp version 9.2.1 on 21.x, 20.x, and 18.x
Prerequisites
Not stated in this extraction

undici

undici version 6.11.1 on 21.x
Affected versions
Not stated in this extraction
Fixed versions
6.11.1
undici version 6.11.1 on 21.x
5.28.4
undici version 5.28.4 on 18.x and 20.x
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2024-27983
Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983)
CVE-2024-27982
HTTP Request Smuggling via Content Length Obfuscation - (CVE-2024-27982)

Publisher severity

No explicit severity was extracted.

Event
#24633 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 18.20.6 (LTS)

Node.js 18.20.6 is a security release fixing HTTP/2 memory leakage and Windows path traversal issues, and updating undici to address insufficiently random values in fetch().

Announced

Node.js · Fixed in 18.20.6undici · Fixed in v5.28.5CVE-2025-23085CVE-2025-23084CVE-2025-22150
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 18.20.6 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
18.20.6
Version 18.20.6 'Hydrogen' (LTS)
Prerequisites
Not stated in this extraction

undici

Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Affected versions
Not stated in this extraction
Fixed versions
v5.28.5
deps: update undici to v5.28.5
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event
#21250 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement