Skip to content
Heist/ feed
HighFix available

Node.js Security Releases

Type: patchSource: Node.js announcements1 source record

Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.

Announced Source revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.

Node.js

Node.js v20.20.2
Affected versions
20.x
The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues.
22.x
The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues.
24.x
The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues.
25.x
The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues.
Fixed versions
Node.js v20.20.2
Node.js v20.20.2
Node.js v22.22.2
Node.js v22.22.2
Node.js v24.14.1
Node.js v24.14.1
Node.js v25.8.2
Node.js v25.8.2
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2026-21637
Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)
CVE-2026-21710
Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)
CVE-2026-21711
Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)
CVE-2026-21712
Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)
CVE-2026-21713
Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)
CVE-2026-21714
Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)
CVE-2026-21717
HashDoS in V8 (CVE-2026-21717)
CVE-2026-21715
Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)
CVE-2026-21716
CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)

Publisher severity

high

2 high severity issues.
Event
#19342 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement