UnratedFix available

Node.js 23.6.1 security release

Type: patchSource: Node.js announcements1 source record

Node.js 23.6.1 addresses security issues involving InternalWorker use with the permission model, HTTP/2 memory leakage, Windows path traversal, and insufficiently random values in undici fetch().

Announced 21 Jan 2025Group revision 1

Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 23.6.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 23.6.1
Version 23.6.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23083
CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event: #20939 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:36:25 GMT
Publisher date: Tue, 21 Jan 2025 17:06:07 GMT

Read the original announcement

Revision history

25 Oct 2026nodejs · Revision 1Source updated