On 1/21/25 12:12, Jan Schaumann wrote:
[Forwarding here because I seem to recall that the
NodeJS team doesn't usually post their announcements
to this list; I have no other affiliation with
NodeJS.]
https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Tuesday, January 21, 2025 Security Releases
Security releases available
Updates are now available for the 23.x, 22.x, 20.x,
18.x Node.js release lines for the following issues.
They've also listed on this page some unusual CVE's:
Along with the security fixes, the Node.js team has also issued CVEs for
End-of-Life (EOL) versions of Node.js.
- Node.js v17.x or prior CVE-2025-23087
- Node.js v19.x CVE-2025-23088
- Node.js v21.x CVE-2025-23089
where the CVE description is just:
This CVE has been issued to inform users that they are using End-of-Life (EOL)
versions of Node.js. These versions are no longer supported and do not receive
updates, including security patches. The continued use of EOL versions may
expose systems to potential security risks due to unaddressed software
vulnerabilities or dependencies (CWE-1104: Use of Unmaintained Third-Party
Components). Users are advised to upgrade to actively supported versions of
Node.js to ensure continued security updates and support.
Their reasons for this are detailed on the blog post at:
https://nodejs.org/en/blog/vulnerability/upcoming-cve-for-eol-versions
including getting CVE scanners to report EOL versions as vulnerable even
if no existing CVE specifically says that they are.
While I can understand their reasoning, I can just imagine the noise if
every project started issuing CVE's for every version that reaches EOL.
--
-Alan Coopersmith- alan.coopersm...@oracle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
