Node.js Multiple Vulnerabilities

Release Date: 22 Jan 2025

RISK: Medium Risk

TYPE: Servers - Other Servers

Multiple vulnerabilities have been identified in Node.js. A remote attacker can exploit these vulnerabilities to trigger denial of service condition, data manipulation and security restriction bypass on the targeted system.

---

Impact

• Denial of Service
• Security Restriction Bypass
• Data Manipulation

---

System / Technologies affected

• Node.js versions prior to 18.20.6 (LTS)
• Node.js versions prior to 20.18.2 (LTS)
• Node.js versions prior to 22.13.1 (LTS)
• Node.js versions prior to 23.6.1 (Current)

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

• Update to Node.js version 18.20.6 (LTS)
• Update to Node.js version 20.18.2 (LTS)
• Update to Node.js version 22.13.1 (LTS)
• Update to Node.js version 23.6.1 (Current)

---

Vulnerability Identifier

• CVE-2025-22150
• CVE-2025-23083
• CVE-2025-23084
• CVE-2025-23085

---

Source

• Node.js

---

Related Link

• https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
• https://nodejs.org/en/blog/release/v18.20.6
• https://nodejs.org/en/blog/release/v20.18.2
• https://nodejs.org/en/blog/release/v22.13.1
• https://nodejs.org/en/blog/release/v23.6.1