Skip to content
Heist/ feed
UnratedFix available

Node.js 20.8.1 (Current)

Type: patchSource: Node.js announcements1 source record

Node.js 20.8.1 fixes multiple security vulnerabilities, including issues involving nghttp2, undici, path traversal, policy integrity checks, and WebAssembly export names.

Announced Group revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 20.8.1 (Current)
Affected versions
Not stated in this extraction
Fixed versions
20.8.1
Node.js 20.8.1 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2023-44487
CVE-2023-44487: nghttp2 Security Release (High)
CVE-2023-45143
CVE-2023-45143: undici Security Release (High)
CVE-2023-39332
CVE-2023-39332: Path traversal through path stored in Uint8Array (High)
CVE-2023-39331
CVE-2023-39331: Permission model improperly protects against path traversal (High)
CVE-2023-38552
CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium)
CVE-2023-39333
CVE-2023-39333: Code injection via WebAssembly export names (Low)

Publisher severity

No explicit severity was extracted.

Event
#26544 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. nodejs · Revision 1Source updated