HighFix available
OpenSSL security releases require Node.js security releases
Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL.
Node.js
Node.js v12.22.11 (LTS)
- Affected versions
- 17.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
16.xImpacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
14.xImpacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
12.xImpacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
- Fixed versions
- v12.22.11
Node.js v12.22.11 (LTS)
v14.19.1Node.js v14.19.1 (LTS)
v16.14.2Node.js v16.14.2 (LTS)
v17.7.2Node.js v17.7.2 (Current)
- Prerequisites
- Not stated in this extraction
OpenSSL
Update to OpenSSL 3.0.2n and 1.1.1n
- Affected versions
- Not stated in this extraction
- Fixed versions
- 3.0.2n
Update to OpenSSL 3.0.2n and 1.1.1n
1.1.1nUpdate to OpenSSL 3.0.2n and 1.1.1n
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2022-0778
(High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates.
Publisher severity
high
The 17.x release line of Node.js is vulnerable to one High severity issue.
- Event
- #33187 · Revision 1
- Added to Heist Feed
- Publisher date