nodejs-january-2025-security-releases: Tuesday, January 21, 2025 Security Releases
Updates are now available for the 23.x, 22.x, 20.x, 18.x Node.js release lines for the following issues.
This security release includes the following dependency updates to address public vulnerabilities:
undici (v7.2.3, v6.21.1, v5.28.5) on v23.x, v22.x, v20.x, v18.x.
Along with the security fixes, the Node.js team has also issued CVEs for End-of-Life (EOL) versions of Node.js.
Node.js v17.x or prior CVE-2025-23087
Node.js v19.x CVE-2025-23088
Node.js v21.x CVE-2025-23089
More information in this blog post
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.2.3 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.21.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 5.28.5
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which Node.js release lines have updates available?
Updates are available for the 23.x, 22.x, 20.x, and 18.x release lines. These releases include undici dependency updates to v7.2.3, v6.21.1, or v5.28.5, depending on the Node.js line.
Are end-of-life Node.js versions covered by the available updates?
The release notes identify CVEs for EOL versions rather than stating that updates are available for them. Node.js v17.x or earlier is associated with CVE-2025-23087, v19.x with CVE-2025-23088, and v21.x with CVE-2025-23089.