UnratedFix available

Node.js 22.13.1 (LTS)

Type: patchSource: Node.js announcements1 source record

Node.js 22.13.1 is a security release addressing multiple vulnerabilities, including issues involving the permission model, HTTP/2, Windows path normalization, and undici fetch().

Announced 21 Jan 2025Source revision 1

Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 22.13.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 22.13.1
Version 22.13.1 'Jod' (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2025-23083
CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
CVE-2025-22150
Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Publisher severity

No explicit severity was extracted.

Event: #20948 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:36:33 GMT
Publisher date: Tue, 21 Jan 2025 17:05:48 GMT

Read the original announcement