HeroDevs
Visit Node NES Home Page

Node.js v22 (Custom) Release Notes

Comprehensive release notes and changelog for Node.js v22 (Custom), including security patches, bug fixes, and feature updates across all supported versions.

132 Patched Vulnerabilities
VEX Statements

This is a custom Node.js version that includes additional patches and features not present in the standard NES Node.js v22 release. It is intended for users who require specific fixes or enhancements that are not available in the official release.

2026-06-25, Version 22.22.10 'Jod' (NES)

This release includes llhttp, nghttp2, and undici.

  • CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB. - (High)
  • CVE-2026-48931 A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is sent before the client has sent the request. - (Low)
  • CVE-2026-48935 A flaw in Node.js Permission API can cause file metadata to be modified even on a path that was set as read-only with --allow-fs-read. - (Low)
  • CVE-2026-48934 A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. - (Medium)
  • CVE-2026-48930 A flaw in Node.js TLS hostname handling — embedded NUL hostnames can lead to silent authority rebinding due to C-string truncation in resolver bindings. - (Medium)
  • CVE-2026-48928 An inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. - (Medium)
  • CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. - (Medium)
  • CVE-2026-48618 A flaw in Node.js TLS hostname handling — unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch. - (High)
  • CVE-2026-48617 A flaw in Node.js Permission Model enforcement allows bypass via process.report.writeReport() path misvalidation. - (Low)
  • CVE-2026-48615 (pending disclosure)
  • CVE-2026-48937 A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame, leading to uncontrolled resource consumption. - (Medium)
  • CVE-2026-10022 Type Confusion in V8 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Medium)
  • CVE-2026-42767 NULL pointer dereference in OpenSSL's CMP client when processing a crafted CMP response with an EncryptedValue structure lacking parameters, causing application crashes and denial of service. (Medium)
  • CVE-2026-9076 Heap buffer over-read in OpenSSL's CMS password-based decryption when a stream-mode cipher is selected instead of a block cipher, triggering an out-of-bounds read and denial of service. (High)
  • CVE-2026-34182 Insufficient input validation on cipher and tag length fields of OpenSSL's CMS AuthEnvelopedData containers allows attackers to substitute authenticated encryption with unauthenticated modes or reduce tag lengths, bypassing integrity checks. (Critical)
  • CVE-2026-34180 Integer truncation in OpenSSL's ASN.1 decoder when content length exceeds 2GB causes a heap buffer over-read on 64-bit platforms, potentially leading to application crashes or memory disclosure. (High)
  • CVE-2026-45446 OpenSSL's AES-SIV and AES-GCM-SIV implementations mishandle authentication of Additional Authenticated Data (AAD) with empty ciphertext, allowing forgery of such messages. (Medium)
  • CVE-2026-45447 Use-after-free in OpenSSL's PKCS#7 signature verification when processing crafted messages with an empty ASN.1 SET in the SignedData digestAlgorithms field may result in process crashes, heap corruption, or remote code execution. (High)
  • CVE-2026-42770 Improper subgroup membership validation in OpenSSL's EVP_PKEY_derive_set_peer() for DHX keys allows a malicious peer to conduct a small-subgroup-confinement attack and potentially recover a victim's private key. (Low)
  • CVE-2026-45445 OpenSSL's AES-OCB cipher implementation silently discards application-supplied initialization vectors when using the EVP_Cipher() one-shot interface, resulting in identical effective nonces and enabling confidentiality loss and authentication tag forgery. (High)
  • CVE-2026-42766 NULL pointer dereference in OpenSSL's CMS decryption when processing specially crafted password-encrypted messages causes application crashes and denial of service. (Medium)
  • CVE-2026-42764 NULL pointer dereference in OpenSSL's QUIC server when address validation is disabled allows a remote attacker to crash the server using an initial packet with an invalid or expired token. (High)
  • CVE-2026-34181 Insufficient input validation in OpenSSL's PKCS#12 PBMAC1 integrity mechanism allows attackers to forge certificates and private keys, potentially enabling unauthorized credential injection. (High)
  • CVE-2026-34183 OpenSSL's QUIC implementation fails to free PATH_RESPONSE frames when a peer never acknowledges them, enabling remote attackers to exhaust heap memory via PATH_CHALLENGE flooding and causing denial of service. (High)
  • CVE-2026-42768 Bleichenbacher-style attack in OpenSSL's CMS_decrypt and PKCS7_decrypt via improper RSA PKCS#1 v1.5 key transport handling allows an attacker to decrypt messages or forge signatures using a victim's private RSA key. (Low)
  • CVE-2026-42769 A typo in OpenSSL's CMP code causes improper certificate validation during root CA key updates, allowing an attacker with RA-level credentials to craft a self-signed certificate accepted by clients as a new trust anchor. (Medium)

2026-04-09, Version 22.22.9 'Iron' (NES)

The CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2026-9358 Uncontrolled recursion in postcss up to 7.1.1 in the toString function of AST Serialization can lead to Denial of Service when processing maliciously crafted CSS. (Medium)

2026-05-28, Version 22.22.8 'Jod' (NES)

The CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2026-33750 Brace pattern with zero step value causes indefinite loop, process hang, and memory allocation issues. (High)
  • CVE-2026-42338 ip-address library does not HTML-escape content in Address6.group() and Address6.link() methods, potentially allowing cross-site scripting attacks when untrusted input is rendered as HTML. (Medium)
  • CVE-2026-33671 Picomatch is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns with nested or overlapping quantifiers, causing excessive CPU consumption and event loop blocking. (High)
  • CVE-2026-33672 Picomatch method injection vulnerability in POSIX_REGEX_SOURCE object allows specially crafted POSIX bracket expressions to reference inherited method names, causing incorrect glob matching behavior and potential security logic errors. (Medium)

2026-05-13, Version 22.22.7 'Jod' (NES)

This release includes commits from the open-source v22.22.3 release.

  • CVE-2026-7902 Out of bounds memory access in V8 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (High)
  • CVE-2026-3543 Inappropriate implementation in V8 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (High)
  • CVE-2026-7899 Out of bounds read and write in V8 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (High)
  • CVE-2026-3542 Inappropriate implementation in WebAssembly allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (High)

2026-05-06, Version 22.22.6 'Jod' (NES)

  • CVE-2026-6301 Type confusion in Turbofan in V8 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (High)

2026-04-22, Version 22.22.5 'Jod' (NES)

  • CVE-2026-33750 Brace pattern with zero step value causes indefinite loop, process hang, and memory allocation issues. (High)
  • CVE-2026-5873 Out of bounds read and write in V8 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (High)
  • CVE-2026-5893 Race in V8 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Medium)
  • CVE-2026-5865 Type Confusion in V8 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (High)
  • CVE-2026-5862 Inappropriate implementation in V8 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (High)
  • CVE-2026-5904 Use after free in V8 allowed an attacker to potentially exploit heap corruption via a crafted extension. (High)
  • CVE-2026-5279 Object corruption in V8 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (High)
  • CVE-2026-31790 RSASVE key encapsulation may send uninitialized memory buffer contents containing sensitive data to malicious peers. (High)
  • CVE-2026-28390 NULL pointer dereference during CMS EnvelopedData processing with KeyTransportRecipientInfo may cause Denial of Service. (High)
  • CVE-2026-31789 Converting excessively large OCTET STRING to hex causes heap buffer overflow on 32-bit platforms. (Critical)
  • CVE-2026-28387 DANE TLSA-based authentication with uncommon TLSA records may result in use-after-free leading to crashes or code execution. (High)
  • CVE-2026-28388 NULL pointer dereference when processing delta CRL with missing CRL Number extension may cause Denial of Service. (High)
  • CVE-2026-28389 NULL pointer dereference during CMS EnvelopedData processing with KeyAgreeRecipientInfo may cause Denial of Service. (High)

2026-04-14, Version 22.22.4 'Jod' (NES)

This release removes the -nes suffix from the runtime version. Versions now use the plain Node.js version string.

2026-03-25, Version 22.22.3 'Jod' (LTS)

This release includes commits from the open-source v22.22.1 security release.

  • CVE-2026-21717 A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process - (Medium)
  • CVE-2026-21716 Permission Model Bypass in realpathSync.native Allows File Existence Disclosure - (Low)
  • CVE-2026-21715 HashDoS in V8 - (Medium)
  • CVE-2026-21714 Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion - (Medium)
  • CVE-2026-21713 Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery - (Medium)
  • CVE-2026-21710 Denial of Service via proto header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) - (High)
  • CVE-2026-4447 Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-4457 Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-3910 Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-2649 Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-21637 Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS - (High)

2026-03-16, Version 22.22.2 'Jod' (NES)

This release includes commits from the open-source v22.22.1 release.

  • CVE-2026-26996 Minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string.
  • CVE-2026-27904 Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds.
  • CVE-2026-27903 Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne() performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent ** (GLOBSTAR) segments and the input path does not match.
  • CVE-2026-27171 zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
  • CVE-2025-0611 Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-1862 Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

2026-01-15, Version 22.22.1 'Jod' (NES)

This release includes commits from the open-source v22.22.0 security release. Some of CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2024-6779 Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-7969 Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-10231 Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-12441 Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
  • CVE-2025-13721 Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
  • CVE-2025-11219 Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low)
  • CVE-2025-14766 Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-59465 Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame. (High)
  • CVE-2025-55130 Bypass File System Permissions using crafted symlinks. (High)
  • CVE-2025-59466 Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers. (Medium)
  • CVE-2025-55131 Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled. (High)
  • CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak. (Medium)
  • CVE-2025-55132 fs.futimes() Bypasses Read-Only Permission Model - (Low)

2025-12-09, Version 22.21.4 'Jod' (NES)

The CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2025-13042 Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-9479 Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
  • CVE-2025-13223 Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-13224 Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-8904 Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-8905 Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium)
  • CVE-2024-9121 Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-9122 Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-9603 Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-9602 Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-11395 Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-6100 Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-0445 Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-12036 Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-12428 Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-12429 Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-12433 Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

2025-11-25, Version 22.21.3 'Jod' (NES)

The CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2024-9859 Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-10230 Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-10231 Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-12693 Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-0999 Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-12432 Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

2025-11-13, Version 22.21.2 'Iron' (NES)

This release includes commits from the open‑source v22.21.1 release. The CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2025-1914 Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-7535 Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-5838 Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

2025-10-13, Version 22.20.2 'Iron' (NES)

The CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2025-11219 Not yet published on NVD.
  • CVE-2025-10891 Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-10585 Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-10892 Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

2025-10-04, Version 22.20.1 'Iron' (NES)

This release includes commits from the open‑source v22.20.0 release. The CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2025-9132 Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-8880 Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

2025-09-04, Version 22.19.1 'Jod' (NES)

This release includes commits from the open‑source v22.19.0 release.

It also includes the following CVEs that do not affect Node.js directly, but are relevant to the bundled dependencies:

  • CVE-2025-0612 Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-0434 Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-7550 Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-6773 Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-6772 Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-5837 Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-5830 Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
  • CVE-2023-4355 Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

2025-08-22, Version 22.18.2 'Jod' (NES)

This release includes the following CVEs that do not affect Node.js directly, but are relevant to the bundled dependencies:

  • CVE-2025-6554 Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

It also fixes a bug that caused the version in process.version to be incorrect.

2025-08-13, Version 22.18.1 'Jod' (NES)

This release includes commits from the open‑source v22.18.0 release.

It also includes the following CVEs that do not affect Node.js directly, but are relevant to the bundled dependencies:

  • CVE-2025-8010 Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-8011 Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-7656 Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-5841 Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
  • CVE-2024-4949 Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

2025-07-16, Version 22.17.2 'Jod' (NES)

This release includes commits from the open‑source v22.17.1 security release.

It also includes the following CVEs that do not affect Node.js directly, but are relevant to the bundled dependencies:

  • CVE-2023-2724 Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
  • CVE-2024-6101 Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-0291 Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2025-6191 Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

2025-06-18, Version 22.16.2 'Jod' (NES)

This release improved backwards compatibility with glibc 2.34.

2025-06-06, Version 22.16.1 'Jod' (NES)

The CVEs addressed in this release do not affect Node.js directly, but they are relevant to the bundled dependencies.

  • CVE-2024-7971 Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.
  • CVE-2024-7965 Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.