UnratedFix available

Node.js 20.18.2 (LTS) security release

Type: patchSource: Node.js announcements1 source record

Node.js 20.18.2 (LTS) addresses multiple security issues, including flaws involving InternalWorker use, HTTP/2, Windows path normalization, and undici fetch().

Announced 21 Jan 2025Group revision 1

Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.18.2 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 20.18.2
Version 20.18.2 'Iron' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23083
CVE-2025-23083 - throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event: #21055 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:38:23 GMT
Publisher date: Tue, 21 Jan 2025 17:05:40 GMT

Read the original announcement

Revision history

25 Oct 2026nodejs · Revision 1Source updated