Skip to content

Blog: add Node.js May 25 Security Releases #7748

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
May 14, 2025
Merged

Blog: add Node.js May 25 Security Releases #7748

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
731c013
Blog: post release announcement May security releases
RafaelGSS May 14, 2025
7eb25d8
Blog: v20.19.2 release post
RafaelGSS May 14, 2025
6220460
Blog: v22.15.1 release post
RafaelGSS May 14, 2025
4df75d7
Blog: v23.11.1 release post
RafaelGSS May 14, 2025
bbfb59d
Blog: v24.0.2 release post
RafaelGSS May 14, 2025
8a5c194
Update apps/site/pages/en/blog/vulnerability/may-2025-security-releas…
RafaelGSS May 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
109 changes: 109 additions & 0 deletions apps/site/pages/en/blog/release/v20.19.2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,109 @@
---
date: '2025-05-14T21:14:45.406Z'
category: release
title: Node v20.19.2 (LTS)
layout: blog-post
author: Rafael Gonzaga
---

## 2025-05-14, Version 20.19.2 'Iron' (LTS), @RafaelGSS

This is a security release.

### Notable Changes

- (CVE-2025-23166) fix error handling on async crypto operation
- (CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
- (CVE-2025-23165) add missing call to uv_fs_req_cleanup

### Commits

- \[[`eb25047b1b`](https://github.com/nodejs/node/commit/eb25047b1b)] - **deps**: update llhttp to 9.2.0 (Node.js GitHub Bot) [#51719](https://github.com/nodejs/node/pull/51719)
- \[[`12dcd8db08`](https://github.com/nodejs/node/commit/12dcd8db08)] - **deps**: update llhttp to 9.1.3 (Node.js GitHub Bot) [#50080](https://github.com/nodejs/node/pull/50080)
- \[[`190e45a291`](https://github.com/nodejs/node/commit/190e45a291)] - **(SEMVER-MAJOR)** **(CVE-2025-23167)** **deps**: update llhttp to 9.1.2 (Paolo Insogna) [#48981](https://github.com/nodejs/node/pull/48981)
- \[[`fc68c44e6a`](https://github.com/nodejs/node/commit/fc68c44e6a)] - **fs**: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) [#57811](https://github.com/nodejs/node/pull/57811)
- \[[`9e13bf0a81`](https://github.com/nodejs/node/commit/9e13bf0a81)] - **(CVE-2025-23165)** **fs**: add missing call to uv_fs_req_cleanup (Justin Nietzel) [#57811](https://github.com/nodejs/node/pull/57811)
- \[[`bd0aa5d44c`](https://github.com/nodejs/node/commit/bd0aa5d44c)] - **(CVE-2024-27982)** **http**: do not allow OBS fold in headers by default (Paolo Insogna) [nodejs-private/node-private#556](https://github.com/nodejs-private/node-private/pull/556)
- \[[`6c57465920`](https://github.com/nodejs/node/commit/6c57465920)] - **(CVE-2025-23166)** **src**: fix error handling on async crypto operations (RafaelGSS) [nodejs-private/node-private#710](https://github.com/nodejs-private/node-private/pull/710)

Windows 32-bit Installer: https://nodejs.org/dist/v20.19.2/node-v20.19.2-x86.msi \
Windows 64-bit Installer: https://nodejs.org/dist/v20.19.2/node-v20.19.2-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v20.19.2/node-v20.19.2-arm64.msi \
Windows 32-bit Binary: https://nodejs.org/dist/v20.19.2/win-x86/node.exe \
Windows 64-bit Binary: https://nodejs.org/dist/v20.19.2/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v20.19.2/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v20.19.2/node-v20.19.2.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v20.19.2/node-v20.19.2-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v20.19.2/node-v20.19.2-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v20.19.2/node-v20.19.2-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v20.19.2/node-v20.19.2-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v20.19.2/node-v20.19.2-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v20.19.2/node-v20.19.2-aix-ppc64.tar.gz \
ARMv7 32-bit Binary: https://nodejs.org/dist/v20.19.2/node-v20.19.2-linux-armv7l.tar.xz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v20.19.2/node-v20.19.2-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v20.19.2/node-v20.19.2.tar.gz \
Other release files: https://nodejs.org/dist/v20.19.2/ \
Documentation: https://nodejs.org/docs/v20.19.2/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

4ba1a64cd4e2d1bdbc38afbf230c6171ed62fca7c38c83497f839c3911d8d13d node-v20.19.2-aix-ppc64.tar.gz
ceeb1753eb6bdaf0d5dada97e807a88ef29d0ce49fa989a84339bc39987956d4 node-v20.19.2-arm64.msi
5f96c725cd2be1151f08b25c05bf5a21866a2dc7db3803d351a6ea19fcc53665 node-v20.19.2-darwin-arm64.tar.gz
51344f84c3867756a381d1f1ac437b9877ef7ee98683cd38aca32133a33e4986 node-v20.19.2-darwin-arm64.tar.xz
29f91e05992a7d81498ab1d04938a184313cb4aaccab95bb4636e30e6424eae3 node-v20.19.2-darwin-x64.tar.gz
eee1053719e234060c39822cc7defcb9322e14a1e6e5046dbbf48dcf68750aa7 node-v20.19.2-darwin-x64.tar.xz
37e920f860aaa3155bf8a276d20a5473fcea9eefa31f8b09eb18dc5e65c9abd7 node-v20.19.2-headers.tar.gz
398d95ff730743659a596b9753c7e619501571ae2beedbe16077d3213cd91e0e node-v20.19.2-headers.tar.xz
24c3090d4e8c3667cd57482263291ca4f562c2e0773d5e618a0c6ba32d21b39f node-v20.19.2-linux-arm64.tar.gz
0d0c4a1c3a5aa657b76873eaa962936c7dc7a45047bd3957322544967713dc72 node-v20.19.2-linux-arm64.tar.xz
aed2de774737d76a81254cbcd12ae5e9239f24efec0456b9608f150d27d58fe7 node-v20.19.2-linux-armv7l.tar.gz
43adc6c3f57582f0ed206b8401816d1846c39996793f02ccf61e905294bfdc58 node-v20.19.2-linux-armv7l.tar.xz
9fced2e270fb0879709f7fa19b358551244b2d6c8cbf39d6a860221dcc12181b node-v20.19.2-linux-ppc64le.tar.gz
1391fe00183bef0da0b478f636527d8270e43563877312d251a468746d338c74 node-v20.19.2-linux-ppc64le.tar.xz
94023e739c98ce55a057fbf5e86589253458e92af1990a2712dab8c6421cfe2f node-v20.19.2-linux-s390x.tar.gz
ffbf836e20738f283cbe342ce92881d81d3f14651cabd2cf93cdb91152bcae3c node-v20.19.2-linux-s390x.tar.xz
eec2c7b9c6ac72e42885a42edfc0503c0e4ee455f855c4a17a6cbcf026656dd5 node-v20.19.2-linux-x64.tar.gz
cbe59620b21732313774df4428586f7222a84af29e556f848abf624ba41caf90 node-v20.19.2-linux-x64.tar.xz
3a19f4949b422309a2806083580528c2c87e8169755f31fb7521d5f7b5fdba22 node-v20.19.2-win-arm64.7z
b155826b6abe8383b88f7de42bc7c2601cabd3b0d6e52cce1cf4cd4936e6441b node-v20.19.2-win-arm64.zip
eb6bde3d812ee065a94fc81e39dc16a56ec41f3039e6a27022326b3b59ee895b node-v20.19.2-win-x64.7z
8735c9940b97548f6d9d4dda7cf5fd4471c062f15f44c2b890c9b0b430460feb node-v20.19.2-win-x64.zip
6e56ea449e6581e8d7251b1960585d4e4cd53d99df34363483099fe864de1023 node-v20.19.2-win-x86.7z
c052c2b4e7ed147f9714b4e81bef4a1c5e04b33162c7300100c547747a2a34f3 node-v20.19.2-win-x86.zip
fcc217f3af52f8ecab1e5d016df6f543cb2d903d57e26f53ac48f7ea837dfab2 node-v20.19.2-x64.msi
2a5c4f9a2a563ba73b866dbdade0157ab042568b49a8b8ec0efa72150843ed17 node-v20.19.2-x86.msi
87f1d17df2fbbd775a4813d8936ece9120135d942eae6d308d2328616eed3103 node-v20.19.2.pkg
eaf8800608ffbcae7665beb4776d8e9d8484055fbb840ef44e346044f9b08ad5 node-v20.19.2.tar.gz
4a7ff611d5180f4e420204fa6f22f9f9deb2ac5e98619dd9a4de87edf5b03b6e node-v20.19.2.tar.xz
c36cb4961a50d2ac05a72d78b6a5b21cb9ac31ca6545a4a438b287f9d0eea9ba win-arm64/node.exe
db56ef1b250e24a698ee3a21f4f055a1f60319f273fa7bcab84212cdf9498bf1 win-arm64/node.lib
b754b00df640e352b663f7907f0e11240258aa5f5059d9c503ce455d2500d92f win-arm64/node_pdb.7z
2b6f70f82b6bbe178556f0b49290011e83c51e63584488d75e7dd9b94560345c win-arm64/node_pdb.zip
5793a3bf18d75c2bc5cb2b65ba8975b30057d7bf443141db4cf970d54fd8ddc6 win-x64/node.exe
21b9f76d6ec91f6510dc5adb891dbd52893c7d242549b5cf6084803d3be91665 win-x64/node.lib
2b7de888145be4086c70866417a0742a87ec50472d8b04e1850701ca2f7bfe4e win-x64/node_pdb.7z
d5493643b36531bb02591c3f855c77e2070bb972be1a51ea313e6b25f3e29556 win-x64/node_pdb.zip
c5505d7f22b1f6bfc56f4fe16f472c3b6428e74f48062028e6cc2a4b646a72cc win-x86/node.exe
4f7899d5cf286aad56624539952c087088e6e90f010f55d1f9145deb45524152 win-x86/node.lib
3b2de193ae323416b1c340777f9c2ff010f337d6dbdbd711a3de4a485315e1b5 win-x86/node_pdb.7z
79647764e20eb5002ca2a27e5d2f115cd5db462661521722a002a1eb0f79cd76 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmglBRIACgkQi+q0389V
XvTuQwv/TK0ElOiurObaWA4Vhya6aXm7zQfNqGVLGo6aBr2vvh5vvUkfA4EjFKGd
HtEygdrrqBxxHSJEtykLwF1Uq0HlO36Jrwrk4qJOQasyKs99qHnXiT1frPlpQv6u
yfuCC6bVSDt80v6OcRcDCitpBgTZY2ig8VAAIhpRDLcZNX/cvhoC5iw2BXbGtWIh
zLshwamTqyJFhP7lSFp2Qka92isinNhJQHEr/E1i7PSOI3hFnF2un5WaYdLOlwJN
uIALWR+Y4HfZy1qRc46znbV0M/xuwjRLGWwnQ3CrKi4G9nLnf57MRID+lgb+82iK
d2nFkDmdjeyN6BV+SJBBTc0KH7iONeHsEJit3Zv+C9j23deXBpNIH5IA4m3BWZV/
iDshOkSBXRRfjT4DJhNK2cdu51Z8GRhlEgkJ4KOL5wwW7zTWKyGPOyJYRzqy6Lbz
1LLGbxeI65fEKKL7QCZP76p5icvq/CQJZexzk2O8LQoxNDXXOWJEagc8aUYH1AkG
isCM12ol
=m+8y
-----END PGP SIGNATURE-----
```
104 changes: 104 additions & 0 deletions apps/site/pages/en/blog/release/v22.15.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
---
date: '2025-05-14T21:15:50.538Z'
category: release
title: Node v22.15.1 (LTS)
layout: blog-post
author: Rafael Gonzaga
---

## 2025-05-14, Version 22.15.1 'Jod' (LTS), @RafaelGSS

This is a security release.

### Notable Changes

- (CVE-2025-23166) fix error handling on async crypto operation
- (CVE-2025-23165) add missing call to uv_fs_req_cleanup

### Commits

- \[[`edaf54da00`](https://github.com/nodejs/node/commit/edaf54da00)] - **fs**: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) [#57811](https://github.com/nodejs/node/pull/57811)
- \[[`9f403e98ef`](https://github.com/nodejs/node/commit/9f403e98ef)] - **(CVE-2025-23165)** **fs**: add missing call to uv_fs_req_cleanup (Justin Nietzel) [#57811](https://github.com/nodejs/node/pull/57811)
- \[[`f4494d38f1`](https://github.com/nodejs/node/commit/f4494d38f1)] - **(CVE-2025-23166)** **src**: fix error handling on async crypto operations (RafaelGSS) [nodejs-private/node-private#709](https://github.com/nodejs-private/node-private/pull/709)

Windows 32-bit Installer: https://nodejs.org/dist/v22.15.1/node-v22.15.1-x86.msi \
Windows 64-bit Installer: https://nodejs.org/dist/v22.15.1/node-v22.15.1-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v22.15.1/node-v22.15.1-arm64.msi \
Windows 32-bit Binary: https://nodejs.org/dist/v22.15.1/win-x86/node.exe \
Windows 64-bit Binary: https://nodejs.org/dist/v22.15.1/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v22.15.1/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v22.15.1/node-v22.15.1.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v22.15.1/node-v22.15.1-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v22.15.1/node-v22.15.1-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v22.15.1/node-v22.15.1-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v22.15.1/node-v22.15.1-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v22.15.1/node-v22.15.1-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v22.15.1/node-v22.15.1-aix-ppc64.tar.gz \
ARMv7 32-bit Binary: https://nodejs.org/dist/v22.15.1/node-v22.15.1-linux-armv7l.tar.xz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v22.15.1/node-v22.15.1-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v22.15.1/node-v22.15.1.tar.gz \
Other release files: https://nodejs.org/dist/v22.15.1/ \
Documentation: https://nodejs.org/docs/v22.15.1/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

2fe635ed920633a890fd594860e5fe35f5ca1ef6da3cda62c6692c39cfefb894 node-v22.15.1-aix-ppc64.tar.gz
3242884a544d8d7e4c1e7ee04ee82e48ae9820723b46589284e86441610f04fa node-v22.15.1-arm64.msi
d2689b86b17e1b51e76f801ffe2d9acca4225e76eda4b843c3d8438d4a7cd6fe node-v22.15.1-darwin-arm64.tar.gz
da2ce4f4616f5adae82de433481e00af86c7e6624a07e5a3c3fdaa1d8a6028fa node-v22.15.1-darwin-arm64.tar.xz
1c722d0dd6d3f60e8b0be014ea01b8a59f5088f4419197a1b37544854d61cc6f node-v22.15.1-darwin-x64.tar.gz
4f7f6dd674ffa4935dba358fe503a396347d918603e3c9657ce586280c702f61 node-v22.15.1-darwin-x64.tar.xz
7410efd260c92faa736cfa56f5cbc41cbb672e20d007d19353992ef9a96c2449 node-v22.15.1-headers.tar.gz
4b625fb4a7c7da9f04f9e897c7ec87a3d9c170504506f184e66d93f4604d2a5b node-v22.15.1-headers.tar.xz
eb3f232b83dfe83397b98395ec77a973e888e8959c978b3e4eeb551b8845b74f node-v22.15.1-linux-arm64.tar.gz
f4ae8ddf7487dfaf7da92fef463ee55cc29d8772d62891361dc3fc8b8e469205 node-v22.15.1-linux-arm64.tar.xz
346426e2bca62c98fb12213c39e80b0e349d7620238f74b7208d12e18fde87fd node-v22.15.1-linux-armv7l.tar.gz
6947386b4c8373b625c6a49b5571bf2226dac7c7b560a9a561a1f81bf71a25ef node-v22.15.1-linux-armv7l.tar.xz
156518af6901fb134ddde5f4b7ee39e047c4154480c3dd93030912a5d3f87097 node-v22.15.1-linux-ppc64le.tar.gz
da07858c6404dbe7c627bd7baea33c7825640652ad24468a6feb23c770cf7ce4 node-v22.15.1-linux-ppc64le.tar.xz
6b5a9615b66e553189578a4be33099f70add96c3b00bf38b7dcd91825ea1672f node-v22.15.1-linux-s390x.tar.gz
7a6206af04399c090aaa7b3d568b1540e127b50931f5022ff2eaf680fc32a9c6 node-v22.15.1-linux-s390x.tar.xz
f4b8eec683708acb1a2a73c7182ba2de5466a5dd5f705934a0830903df28821c node-v22.15.1-linux-x64.tar.gz
7dca2ab34ec817aa4781e2e99dfd34d349eff9be86e5d5fbaa7e96cae8ee3179 node-v22.15.1-linux-x64.tar.xz
2cafb8c5ee545d387409b6dab34b3552c90e247b7d2bd3964a68f42b26b3e8bf node-v22.15.1-win-arm64.7z
dec85d230d45a6319130cbc844e8ecf8767b150bfeddd340f6b7c4a2e8c3ccb8 node-v22.15.1-win-arm64.zip
3abcca34447dace08cecd2bfd7b6521b22bfa89cff7bd70e7cde777218c84d6a node-v22.15.1-win-x64.7z
7c7997d6ef2efd9525a54b033fc0be6f22549a5905f5da6573a41e61a436a1b5 node-v22.15.1-win-x64.zip
7b9999b5da0933f677ffff2a9ab211aebdcf23b1ed0f2e1db573cea757944103 node-v22.15.1-win-x86.7z
dd432043e8c90b7f221bd3ba8e6443fb69e7b8273049fad0669a3a7d66939985 node-v22.15.1-win-x86.zip
facb02bdf67cb9a7519c192b504fbfdbf47d8a67f36696d7d91a069b69904398 node-v22.15.1-x64.msi
89ef1c6181749a7739f6df58a73aa2127d0c7d6afe0236f5998d69ec98ec2154 node-v22.15.1-x86.msi
839f599498d36fabc3f7c940cabbaf14844e6380ba97a91299f7378b69e675c6 node-v22.15.1.pkg
38aea029f8818f7783f273fbc70dcf930f9ef54bdd49c5f90c0152caec7a57be node-v22.15.1.tar.gz
c19f0177d21c621746625e5f37590bd0d79a72043b77b53784cba5f145e7263e node-v22.15.1.tar.xz
e9e669cf7e9772406e3a59cb4b9b606e75eb1d9f454b675e1c78a6aaa542b31d win-arm64/node.exe
6c43922c747e0c07fcc4ceb64f08e98854a5c1b31665764076f5783556973d16 win-arm64/node.lib
957076a2623c6f9355a21aba2031a7248d411a6f40950e7b710fbf76a666f5e9 win-arm64/node_pdb.7z
5ac29419b5aaa475ba0606a021ed5cea77b18df74b5e42d57a706011004f6be4 win-arm64/node_pdb.zip
b3191cc083480282f1edaa3324002c320704a00d7564cf1f7c48b610d1c060b6 win-x64/node.exe
e731ad9af05eabe6bd941442b19dd6037f559a19a2fa8df2a8297ccb46ed7577 win-x64/node.lib
84eec3bf646e04287fef10dc110a7aa82a4304ddcbd0b148aa90c0d44b08ea1d win-x64/node_pdb.7z
b8b3364ad0735d45c25fb19c8b49f4c5e0c72a94f5d8fa44abddd80c15715538 win-x64/node_pdb.zip
ddd0ef952950dcaa7f705bdde5f4fd0c8a78a7c6db6dad32f8e13e3b120ad5e4 win-x86/node.exe
5f66397542e27adb288e1742720cedbeaba8a2034ebd58397306b2905f4acd2d win-x86/node.lib
e5bd0ae9dc388aa4fd72067e3239333537c42329746124437c32b81ff2291ef4 win-x86/node_pdb.7z
b5e39e2168abe7c9418f2cebcd813db9c1a0841274b1405aeffe13ffef74c264 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmglBa4ACgkQi+q0389V
XvTAhQv8DzNseoHxhjMLTvSh8qGz8rV3dp8TpeFfJUgseZEoeq6DykvS9bA18ilB
od5YkHPQap/xWO89UJ0nq50HVySuCsTSOFDrDShzumVkgEtzCUFuFS4ZyQHJpYwi
56Fk+sea5QbzjbG/Fg/L2bgyNXmpdmjYejw6fw5AkVLk8p5OgLHDGFrGrezQ2NWO
qH1V0R5m6XBtJyNIep9l7PJ+XPTxg7KMSG8u5gXzvlHsg8aaIY1ejCnAlPgzs/hD
Qu1fGcG5vFpdOMGctu+WjgaULyOJidDxbvvuYl18ZXcLeQw5pRTsik7GBsWBcTZo
5ccsUDNqx9noSrZImwZW4L1jR12yV6Tb9pwdbX698mplZLPNUVMWNcdAgdVgmpuh
pISSOw3m3VpUt7n/l+OmKOVavY22zn8GkOYQsk2js3+ltREFbdI+XfcU/Grx/K0k
tBu86dVM0UojHB3tcR44/ZCB4YctQYBjznUgaM9TMvL8E0rfwXLtXhBS64jziNw4
QO0+Nrm3
=scbF
-----END PGP SIGNATURE-----
```
Loading
Loading