nodejs-december-2025-security-releases: Tuesday, January 13, 2026 Security Releases
Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address:
3 high severity issues.
4 medium severity issues.
1 low severity issue.
This security release includes the following dependency updates to address public vulnerabilities:
c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x
undici (6.23.0, 7.18.0) on 20.x, 22.x, 24.x, 25.x
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.34.6 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.23.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.18.0
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Node.js release lines have security updates available?
Updates are available for the 20.x, 22.x, 24.x, and 25.x release lines.
How many issues are addressed, and what are their reported severities?
The release addresses eight issues: three high-severity, four medium-severity, and one low-severity issue.
Which bundled dependencies were updated as part of these releases?
c-ares was updated to 1.34.6, and undici was updated to 6.23.0 and 7.18.0. These dependency updates apply across the 20.x, 22.x, 24.x, and 25.x release lines.