Software Detail
Title
CRITICAL
HIGH
MEDIUM
LOW
CVE
CWE
Number of items displayed
node.js Number Of NVD 149 CRITICAL 13 HIGH 91 MEDIUM 44 LOW 1
URL https://nodejs.org/
Explanation Node.js releases a major version every 6 months.

The status of each version includes

Current : Added features

Active LTS : New stable features, bug fixes, and other updates are made by the LTS team.

Maintenance LTS : New features are added, major bug fixes and security updates are made by the LTS team. New features will only be added if they can be migrated to subsequent versions.

Odd-numbered releases (9, 11, etc.) will be Current and will be supported by the developers for 6 months only.
Even-numbered releases (10, 12, etc.) will be released after support for odd-numbered releases expires, and will be supported as Current for 6 months by the developers.
After 6 months of even-numbered releases, the system will move to Active LTS for 12 months and become generally available.
After the end of Active LTS, the system will move to Maintenance LTS for 12 months.
Even-numbered releases are usually guaranteed to have critical bugs fixed for a total of 30 months.

Only Active LTS and Maintenance LTS Node.js should be used in commercial products.
Tag
  • MIT License
  • Javascript

Add Information URL
No Type Name URL
1 https://nodejs.org/en/blog/
2 https://nodejs.org/en/blog/release/
3 https://nodejs.org/en/about/releases/
4 https://github.com/nodejs/Release

List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support
Extended
for a fee
Critical High Medium Low
1 Node.js 19 19.7.0 Feb. 21, 2023 Oct. 18, 2022 0 5 2 0
2 Node.js 18 (LTS) 18.15.0 March 7, 2023 April 19, 2022 Oct. 18, 2023 April 30, 2025 2 15 8 0
3 Node.js 17 17.9.1 June 2, 2022 Oct. 19, 2021 April 1, 2022 June 1, 2022 0 3 2 0
4 Node.js 16 (LTS) 16.19.1 Feb. 16, 2023 April 20, 2021 Oct. 18, 2022 April 30, 2024 4 16 12 0
5 Node.js 15 15.14.0 April 6, 2021 Oct. 20, 2020 June 1, 2021 1 6 3 0
6 Node.js 14 (LTS) 14.21.3 Feb. 16, 2023 April 21, 2020 Oct. 18, 2021 April 30, 2023 3 22 13 0
7 Node.js 13 13.14.0 April 30, 2020 Oct. 22, 2019 June 1, 2020 2 1 0 0
8 Node.js 12 (LTS) 12.22.12 April 5, 2022 April 23, 2019 Oct. 21, 2019 April 30, 2022 4 24 9 0
9 Node.js 11 11.15.0 April 30, 2019 Oct. 23, 2018 June 1, 2019 0 4 5 0
10 Node.js 10 (LTS) 10.24.1 April 6, 2021 April 24, 2018 May 18, 2020 April 30, 2021 2 28 10 0
11 Node.js 9 9.11.2 June 12, 2018 Oct. 1, 2017 June 30, 2018 1 8 4 1
12 Node.js 8 (LTS) 8.17.0 Dec. 17, 2019 May 30, 2017 Dec. 31, 2018 Dec. 31, 2019 1 23 9 1
13 Node.js 7 7.10.1 July 11, 2017 Oct. 25, 2016 June 30, 2017 2 7 4 0
14 Node.js 6 (LTS) 6.17.1 April 3, 2019 Oct. 18, 2016 April 29, 2018 April 30, 2019 4 24 16 0
15 Node.js 5 5.12.0 June 23, 2016 Oct. 29, 2015 June 30, 2016 1 16 8 0
16 Node.js 4 (LTS) 4.9.1 March 30, 2018 Sept. 8, 2015 March 30, 2017 April 30, 2018 April 1, 2017 6 25 13 0
17 Node.js 3.0 3.0.0 0 5 3 0
18 Node.js 2.0 2.0.2 0 5 3 0
19 Node.js 1 1.1.0 0 10 10 0
20 Node.js 0 0.0.6 2 22 16 0
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2
Level
Attach Vector
Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date
Show Affected Exploit
PoC
Search
1 5.3
-
MEDIUM
Network
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could fo… NVD-CWE-noinfo
CVE-2023-30588 cpe:2.3:a:nodejs:node.js:*:* 20.0.0
18.0.0
16.0.0




20.3.1
18.16.1
16.20.1
2023-12-5 02:40
2023-11-29
Show GitHub Exploit DB Packet Storm
2 7.5
-
HIGH
Network
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the functi… NVD-CWE-Other
CVE-2023-30590 cpe:2.3:a:nodejs:node.js:*:* 20.0.0
18.0.0
16.0.0




20.3.1
18.16.1
16.20.1
2024-03-27 12:15
2023-11-29
Show GitHub Exploit DB Packet Storm
3 7.5
-
HIGH
Network
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges d… NVD-CWE-noinfo
CVE-2023-30585 cpe:2.3:a:nodejs:node.js:*:* 20.0.0
18.0.0
16.0.0




20.3.1
18.16.1
16.20.1
2023-12-2 13:39
2023-11-28
Show GitHub Exploit DB Packet Storm
4 7.5
-
HIGH
Network
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using th… NVD-CWE-noinfo
CVE-2023-30581 cpe:2.3:a:nodejs:node.js:*:* 20.0.0
16.0.0
18.0.0




20.3.1
16.20.1
18.16.1
2023-12-12 05:49
2023-11-23
Show GitHub Exploit DB Packet Storm
5 7.5
-
HIGH
Network
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself agai… CWE-22
Path Traversal
CVE-2023-39331 cpe:2.3:a:nodejs:node.js:*:* 20.0.0 20.8.0 2023-11-18 04:10
2023-10-18
Show GitHub Exploit DB Packet Storm
6 9.8
-
CRITICAL
Network
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path travers… CWE-22
Path Traversal
CVE-2023-39332 cpe:2.3:a:nodejs:node.js:*:* 20.0.0 20.8.0 2023-11-18 04:08
2023-10-18
Show GitHub Exploit DB Packet Storm
7 7.5
-
HIGH
Network
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementa… CWE-345
 Insufficient Verification of Data Authenticity
CVE-2023-38552 cpe:2.3:a:nodejs:node.js:*:* 20.1.0
18.0.0
20.8.0
18.18.1


2024-02-17 02:11
2023-10-18
Show GitHub Exploit DB Packet Storm
8 7.5
-
HIGH
Network
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CWE-400
 Uncontrolled Resource Consumption
CVE-2023-44487 cpe:2.3:a:nodejs:node.js:*:* 18.0.0
20.0.0


18.18.2
20.8.1
2024-04-26 18:15
2023-10-10
Show GitHub Exploit DB Packet Storm
9 7.5
-
HIGH
Network
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.… CWE-22
Path Traversal
CVE-2023-32558 cpe:2.3:a:nodejs:node.js:*:* 20.0.0 20.5.1 2023-12-4 23:57
2023-09-12
Show GitHub Exploit DB Packet Storm
10 5.3
-
MEDIUM
Network
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an … CWE-732
 Incorrect Permission Assignment for Critical Resource
CVE-2023-32005 cpe:2.3:a:nodejs:node.js:*:* 20.0.0 20.5.1 2023-12-23 02:07
2023-09-12
Show GitHub Exploit DB Packet Storm