Skip to content
Heist/ feed
UnratedFix available

Node.js security releases

Type: patchSource: Node.js announcements1 source record

Node.js released security updates for active 20.x, 22.x, 24.x, and 25.x lines, addressing multiple vulnerabilities. The announcement lists updated release versions and reports high, medium, and low severity issues.

Announced Group revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address: 3 high severity issues. 4 medium severity issues. 1 low severity issue.

Node.js

Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines
Affected versions
20.x
This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x
22.x
This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x
24.x
This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x
25.x
This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x
Fixed versions
Node.js 20.20.0
Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0
Node.js 22.22.0
Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0
Node.js 24.13.0
Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0
Node.js 25.3.0
Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2025-55131
Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)
CVE-2025-55130
Bypass File System Permissions using crafted symlinks (CVE-2025-55130)
CVE-2025-59465
Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)
CVE-2025-59466
Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)
CVE-2025-59464
Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)
CVE-2026-21636
Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)
CVE-2026-21637
TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)
CVE-2025-55132
fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)

Publisher severity

No explicit severity was extracted.

Event
#19349 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. nodejs · Revision 1Source updated