HighFix available
Node.js security releases for July 15, 2025
Node.js released updates addressing two high-severity issues: a Windows path traversal protection bypass and HashDoS in V8.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Security releases available Updates are now available for the 24.x, 22.x, 20.x Node.js release lines for the following issues.
Node.js
The Node.js Project
- Affected versions
- 20.x
This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
22.xThis vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
24.xThis vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
- Fixed versions
- Node.js v20.19.4
Node.js v20.19.4
Node.js v22.17.1Node.js v22.17.1
Node.js v24.4.1Node.js v24.4.1
- Prerequisites
- Windows users of path.join API
This vulnerability affects Windows users of path.join API.
- Related CVEs
- CVE-2025-27210
(CVE-2025-27210)
CVE-2025-27209(CVE-2025-27209)
Publisher severity
high
2 high severity issues.
- Event
- #19355 · Revision 1
- Added to Heist Feed
- Publisher date