Node.js v18 Release Notes

2025-07-31, Version 18.20.11 'Hydrogen' (NES)

• CVE-2025-27210 An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API.

2025-05-16, Version 18.20.10 'Hydrogen' (NES)

• CVE-2025-23166 A vulnerability has been identified in Node.js, the C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
• CVE-2025-23167 A flaw in Node.js HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

2025-03-27, Version 18.20.9 'Hydrogen' (NES)

• Update dependencies to match OSS v18.20.8

2025-02-20, Version 18.20.8 'Hydrogen' (NES)

• Update dependencies to match OSS v18.20.7

2024-01-30, Version 18.20.7 'Hydrogen' (NES)

• CVE-2025-23084 A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of path.join API.
• CVE-2025-23085 There's a vulnerability in NodeJS when handling HTTP/2 connections when the remote peer abruptly closes the socket without sending the proper HTTP/2 notification to the server. This vulnerability leads NodeJS to a memory leak, an attacker may leverage that in order to force the targeted process in the targeted host to an uncontrollable resource consumption state, starving the process itself and possibly other processes running at the same host to memory starvation. As a result Denial of Service can be achieved.
• CVE-2025-22150 Undici uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values.

2024-10-10, Version 18.20.6 'Hydrogen' (NES)

• CVE-2024-5274 Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• Update OpenSSL to 3.0.14-quic1

2024-09-20, Version 18.20.5 'Hydrogen' (NES)

This patch contains the fix for 2 vulnerabilities in V8 that are not directly applicable to Node.js:

• CVE-2024-4947 (V8) Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
• CVE-2024-4761 (V8) Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)