Skip to content
Heist/ feed
UnratedFix available

Node.js Security Releases (Update 16-February-2023)

Type: patchSource: Node.js announcements1 source record

Node.js security releases address OpenSSL updates and multiple vulnerabilities across the 14.x, 16.x, 18.x, and 19.x release lines. Released versions are listed below.

Announced Source revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues.

Node.js

Node.js v14.21.3 (LTS)
Affected versions
19.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
18.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
16.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
14.x
All versions of the 19.x, 18.x, 16.x, and 14.x release lines.
Fixed versions
v14.21.3
Node.js v14.21.3 (LTS)
v16.19.1
Node.js v16.19.1 (LTS)
v18.14.1
Node.js v18.14.1 (LTS)
v19.6.1
Node.js v19.6.1 (Current)
Prerequisites
--experimental-policy
This only affects users who had enabled the experimental permissions option with --experimental-policy.
Related CVEs
CVE-2023-23918
Node.js Permissions policies can be bypassed via process.mainModule (High) (CVE-2023-23918)
CVE-2023-23919
Node.js OpenSSL error handling issues in nodejs crypto library (Medium) (CVE-2023-23919)
CVE-2023-23936
Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) (CVE-2023-23936)
CVE-2023-24807
Regular Expression Denial of Service in Headers in Node.js fetch API(Low) (CVE-2023-24807)
CVE-2023-23920
Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) (CVE-2023-23920)

Publisher severity

No explicit severity was extracted.

Event
#29062 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement