Unrated
OpenSSL Security Advisory Assessment, January 2026
The Node.js Project reports that three OpenSSL vulnerabilities affect Node.js branches through PFX certificate processing. The issues require a specially crafted PFX file; updates are planned for upcoming regular Node.js releases.
Announced Source revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
The OpenSSL project released a security advisory that includes 12 CVEs. After assessment, we have concluded that three CVEs affect Node.js (severity Low to Moderate).
Node.js
three CVEs affect Node.js
- Affected versions
- v20.x
v20.x 3.0.15 Yes
v22.xv22.x 3.5.4 Yes
v24.xv24.x 3.5.4 Yes
v25.xv25.x 3.5.4 Yes
mainmain 3.5.4 Yes
- Fixed versions
- Not stated in this extraction
- Prerequisites
- An attacker would need to provide a specially crafted PFX file
An attacker would need to provide a specially crafted PFX file to trigger any of these issues.
- Related CVEs
- CVE-2025-11187
CVE-2025-11187: Stack buffer overflow in PBMAC1 MAC verification - Moderate
CVE-2025-69421CVE-2025-69421: NULL pointer dereference in PKCS12_item_decrypt_d2i_ex() - Low
CVE-2026-22795CVE-2026-22795: Type confusion during PKCS#12 parsing - Low
Publisher severity
No explicit severity was extracted.
- Event
- #19344 · Revision 1
- Added to Heist Feed
- Publisher date