Node.js v18 Release Notes

2025-02-20, Version 18.20.8 'Hydrogen' (NES)

• Update dependencies to match OSS v18.20.7

2024-01-30, Version 18.20.7 'Hydrogen' (NES)

• CVE-2025-23084 A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of path.join API.
• CVE-2025-23085 There's a vulnerability in NodeJS when handling HTTP/2 connections when the remote peer abruptly closes the socket without sending the proper HTTP/2 notification to the server. This vulnerability leads NodeJS to a memory leak, an attacker may leverage that in order to force the targeted process in the targeted host to an uncontrollable resource consumption state, starving the process itself and possibly other processes running at the same host to memory starvation. As a result Denial of Service can be achieved.
• CVE-2025-22150 Undici uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values.

2024-10-10, Version 18.20.6 'Hydrogen' (NES)

• CVE-2024-5274 Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• Update OpenSSL to 3.0.14-quic1

2024-09-20, Version 18.20.5 'Hydrogen' (NES)

This patch contains the fix for 2 vulnerabilities in V8 that are not directly applicable to Node.js:

• CVE-2024-4947 (V8) Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
• CVE-2024-4761 (V8) Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)