UnratedFix available
Node.js security releases available
Node.js security updates address three vulnerabilities affecting supported release lines. Updated releases include Node.js v20.19.2, v22.15.1, v23.11.1, and v24.0.2.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for the 24.x, 23.x, 22.x, 20.x Node.js release lines for the following issues.
Node.js
Node.js v20.19.2
- Affected versions
- 20.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
22.xThis vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
23.xThis vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
24.xThis vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x
- Fixed versions
- Node.js v20.19.2
Node.js v20.19.2
Node.js v22.15.1Node.js v22.15.1
Node.js v23.11.1Node.js v23.11.1
Node.js v24.0.2Node.js v24.0.2
- Prerequisites
- Not stated in this extraction
Node.js
A flaw in Node.js 20's HTTP parser
- Affected versions
- Node.js 20.x users prior to the llhttp v9 upgrade
This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
- Fixed versions
- llhttp to version 9
The issue was resolved by upgrading llhttp to version 9
- Prerequisites
- Not stated in this extraction
Node.js
In Node.js, the ReadFileUtf8 internal binding
- Affected versions
- v20 and v22
This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22.
- Fixed versions
- Node.js v20.19.2
Node.js v20.19.2
Node.js v22.15.1Node.js v22.15.1
- Prerequisites
- Windows systems relying on the ReadFileUtf8 API
This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22.
- Related CVEs
- CVE-2025-23166
Improper error handling in async cryptographic operations crashes process (CVE-2025-23166)
CVE-2025-23167Improper HTTP header block termination in llhttp (CVE-2025-23167)
CVE-2025-23165Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165)
Publisher severity
No explicit severity was extracted.
- Event
- #19567 · Revision 1
- Added to Heist Feed
- Publisher date