{"id":"VND-nodejs-april-2024-security-releases-2","kind":"vulnerability","aliases":[],"related":["CVE-2024-27980"],"title":"Node.js: Wednesday, April 10, 2024 Security Releases","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners Wednesday, April 10, 2024 Security Releases RG Rafael Gonzaga Wednesday, April 10, 2024 Security Releases Security releases available\nUpdates are now available for the 18.x, 20.x, 21.x Node.js release lines for the\nfollowing issues.\nCommand injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) - (HIGH)\nDue to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.\nIt is important to note that there has been a breaking change for Windows users who utilize child_process.spawn and child_process.spawnSync .\nNode.js will now error with EINVAL if a .bat or .cmd file is passed to child_process.spawn and child_process.spawnSync without the shell option set.\nIf the input to spawn / spawnSync is sanitized, users can now pass { shell: true } as an option to prevent the occurrence of EINVALs errors.\nWhile it is possible to also pass --security-revert=CVE-2024-27980 to revert the security patch, we strongly advise against doing so.\nImpact:\nThis vulnerability affects all Windows users in active release lines: 18.x, 20.x, 21.x\nThank you, to ryotak for reporting this vulnerability and thank you Ben Noordhuis for fixing it.\nSummary\nThe Node.js project will release new versions of the 18.x, 20.x, 21.x\nreleases lines on or shortly after, Tuesday, April 9, 2024 in order to address:\n1 high severity issues.\nImpact\nThe 18.x release line of Node.js is vulnerable to 1 high severity issue.\nThe 20.x release line of Node.js is vulnerable to 1 high severity issue.\nThe 21.x release line of Node.js is vulnerable to 1 high severity issue.\nRelease timing\nReleases will be available on, or shortly after, Tuesday, April 9, 2024.\nContact and future updates\nThe current Node.js security policy can be found at https://nodejs.org/en/security/ .\nPlease follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous Monday, July 8, 2024 Security Releases Next Wednesday, April 3, 2024 Security Releases","summary":"On Windows, child_process.spawn and spawnSync mishandle .bat and .cmd files, so a crafted command line argument can inject and run arbitrary commands even when the shell option is off. Node.js now throws EINVAL for batch files passed without shell set, which can break existing code.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":[],"affected":"","ecosystem":"node"},{"name":"node","fixed":[],"affected":"18.x","ecosystem":"node"},{"name":"node","fixed":[],"affected":"20.x","ecosystem":"node"},{"name":"node","fixed":[],"affected":"21.x","ecosystem":"node"}],"ecosystems":["node"],"tags":["node","runtime","self-hosted","windows"],"not_affected_if":["linux-only","macos-only","no-user-controlled-spawn-args"],"how_to_check":"- Run `node --version` and compare against the fixed releases listed in the Fix field.\n- Search the codebase for `child_process.spawn` and `child_process.spawnSync` calls that run .bat or .cmd files or pass user-controlled arguments on Windows.","fix":"- Upgrade Node.js 18.x, 20.x and 21.x to the patched releases published with the April 2024 security release (exact versions unknown from sources).\n- Where spawn input is sanitized and runs batch files, pass `{ shell: true }` to avoid the new EINVAL error.\n- Do not use `--security-revert=CVE-2024-27980`.","status":"open","published_at":"2024-04-10T00:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:39:32+00:00","updated_at":"2026-10-25T05:39:32+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:39:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 18.x, 20.x and 21.x to the patched releases published with the April 2024 security release (exact versions unknown from sources).\n- Where spawn input is sanitized and runs batch files, pass `{ shell: true }` to avoid the new EINVAL error.\n- Do not use `--security-revert=CVE-2024-27980`.","reach":"unknown","title":"Node.js on Windows: spawn with batch files lets arguments run commands","impact":"high","summary":"On Windows, child_process.spawn and spawnSync mishandle .bat and .cmd files, so a crafted command line argument can inject and run arbitrary commands even when the shell option is off. Node.js now throws EINVAL for batch files passed without shell set, which can break existing code.","category":"runtime","nicknames":[],"who_cares":["node","windows","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker-supplied arguments run arbitrary commands on the Windows host.","analyst_note":"Fixed version numbers and the exact attacker-controlled input path are not in the sources; check https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2 for the patched versions.","how_to_check":"- Run `node --version` and compare against the fixed releases listed in the Fix field.\n- Search the codebase for `child_process.spawn` and `child_process.spawnSync` calls that run .bat or .cmd files or pass user-controlled arguments on Windows.","needs_analyst":true,"not_affected_if":["linux-only","macos-only","no-user-controlled-spawn-args"],"who_is_affected":"Windows users of Node.js 18.x, 20.x and 21.x who call child_process.spawn or child_process.spawnSync with arguments that can carry attacker-controlled text. The sources state the flaw affects all Windows users on those release lines. Non-Windows systems are not described as affected.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":4211,"output_tokens":710,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2024':141C,254C '-27980':142C,255C '/en/security/':406C '/forum/#!forum/nodejs-sec':442C '/nodejs/node/blob/master/security.md':415C '1':330C,345C,359C,373C '10':4A,92C,101C '18':114C,278C,310C,336C '2':16A '20':116C,280C,312C,350C '2024':5A,12A,93C,102C,325C,390C,471C,478C '21':118C,282C,314C,364C '3':477C '8':470C '9':324C,389C 'achiev':165C 'activ':275C 'address':329C 'advis':263C 'affect':270C 'also':248C 'announc':432C 'announcement-on':431C 'april':3A,11A,91C,100C,323C,388C,476C 'arbitrari':47B,162C 'arg':130C 'argument':42B,159C 'avail':82C,107C,111C,382C 'bat':33B,204C 'batch':61B,150C 'ben':295C 'break':69B,186C 'chang':187C 'child_process.spawn':29B,133C,153C,193C,211C 'child_process.spawnsync':154C,195C,213C 'cmd':35B,206C 'code':71B,166C 'command':40B,48B,127C,157C,163C 'commerci':72C 'contact':391C 'craft':39B 'current':396C 'cve':140C,253C 'date':447C 'due':144C 'ecosystem':86C 'einval':59B,201C,241C 'enabl':137C,175C 'error':199C,242C 'even':49B,168C 'execut':167C 'exist':70B 'file':36B,62B,151C,207C 'fix':298C 'follow':125C,408C 'found':402C 'futur':393C 'github':465C 'github.com':414C 'github.com/nodejs/node/blob/master/security.md':413C 'gonzaga':98C 'groups.google.com':441C 'groups.google.com/forum/#!forum/nodejs-sec':440C 'handl':148C 'high':143C,331C,346C,360C,374C 'host':25B 'impact':267C,334C 'import':178C 'improp':147C 'inject':44B,128C,161C 'input':221C 'issu':126C,333C,348C,362C,376C 'juli':469C 'line':41B,122C,158C,277C,317C,339C,353C,367C 'list':438C 'low':429C 'low-volum':428C 'lts':79C 'mail':437C 'maintain':461C 'mainten':78C 'malici':156C 'mishandl':32B 'monday':468C 'new':306C 'next':474C 'node':17A,18A,19A,20A,21B 'node.js':1A,56B,120C,196C,302C,341C,355C,369C,397C,424C,457C 'nodej':435C,464C 'nodejs':10A 'nodejs-sec':434C 'nodejs.org':405C 'nodejs.org/en/security/':404C 'noordhui':296C 'note':180C 'occurr':239C 'openj':85C 'option':53B,136C,172C,217C,235C 'order':327C 'organ':466C 'outlin':411C 'paramet':131C 'partner':89C 'pass':63B,209C,230C,249C 'past':76C 'patch':260C 'phase':80C 'pleas':407C 'polici':399C 'possibl':246C 'prevent':237C 'previous':467C 'process':410C 'program':88C 'project':303C,460C 'rafael':97C 'relat':454C 'releas':7A,95C,104C,106C,121C,276C,305C,316C,338C,352C,366C,377C,379C,455C,473C,480C 'releases':15A 'report':289C,420C 'revert':252C,257C 'rg':96C 'run':46B 'runtim':22B 'ryotak':287C 'sanit':226C 'sec':436C 'secur':6A,94C,103C,105C,251C,259C,398C,449C,453C,472C,479C 'security':14A 'security-rel':452C 'security-releases':13A 'security-revert':250C 'self':24B 'self-host':23B 'set':66B,218C 'sever':332C,347C,361C,375C 'shell':52B,65B,135C,171C,216C,231C 'short':320C,385C 'spawn':223C 'spawnsync':31B,224C 'stay':444C 'strong':262C 'subscrib':425C 'summari':300C 'support':73C 'sustain':87C 'thank':284C,293C 'throw':58B 'time':378C 'true':232C 'tuesday':322C,387C 'updat':108C,394C 'user':190C,227C,273C 'util':192C 'version':75C,307C 'via':129C 'vnd':9A 'vnd-nodejs-april':8A 'volum':430C 'vulner':269C,291C,343C,357C,371C,422C,450C 'wednesday':2A,90C,99C,475C 'window':26B,28B,139C,189C,272C 'wish':418C 'without':64B,134C,214C 'x':115C,117C,119C,279C,281C,283C,311C,313C,315C,337C,351C,365C","nicknames":[],"mitigations":[],"who_affected":"Windows users of Node.js 18.x, 20.x and 21.x who call child_process.spawn or child_process.spawnSync with arguments that can carry attacker-controlled text. The sources state the flaw affects all Windows users on those release lines. Non-Windows systems are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-10T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"april-2024-security-releases-2","url":"https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2","severity":"high","published_at":"2024-04-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-26T01:09:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}