{"id":"VND-nodejs-openssl-and-zlib-vulnerability-assessment","kind":"vulnerability","aliases":[],"related":["CVE-2022-3358","CVE-2022-37434"],"title":"Node.js: OpenSSL and zlib update assessment, and Node.js Assessment workflow","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners OpenSSL and zlib update assessment, and Node.js Assessment workflow RG Rafael Gonzaga OpenSSL and zlib update assessment, and Node.js Assessment workflow Summary\nThe vulnerability in the OpenSSL Security release of Oct 11 2022 does not affect any active Node.js release lines, as well\nas the zlib vulnerability ( CVE-2022-37434 ) patched on the zlib Security release of Oct 13 2022, does not affect Node.js.\nAnalysis OpenSSL\nOur assessment of the security advisory is:\nUsing a Custom Cipher with NID_undef may lead to NULL encryption (CVE-2022-3358)\nNode.js doesn't call EVP_CIPHER_meth_new(NID_undef, ...) . Therefore, Node.js is not affected by this vulnerability.\nAnalysis zlib\nOur assessment of the CVE-2022-37434 is:\nBuffer overflow in inflate via a large gzip header extra field\nNode.js doesn't call inflateGetHeader . Therefore, Node.js is not affected by this vulnerability.\nFurther information, see: nodejs-dependency-vuln-assessments#50 .\nNode.js Vulnerability Assessment workflow\nThe Node.js Security team created an automated workflow that aims to address all the public CVE of Node.js dependencies.\nThis initiative aims to reduce the gap between a dependency security release and a Node.js assessment.\nThe repository is available at nodejs/nodejs-dependency-vuln-assessments , and the assessments are made through the\nissues.\nEnsure to watch the repository if you are interested in security patches.\nContact and future updates\nThe current Node.js security policy can be found at https://github.com/nodejs/node/security/policy#security ,\nincluding information on how to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at\nhttps://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on\nsecurity vulnerabilities and security-related releases of Node.js and the\nprojects maintained in the\nNode.js GitHub organization . Previous OpenSSL November Security Release Next September 23rd 2022 Security Releases","summary":"Node.js's security team reviewed the October 2022 OpenSSL CVE-2022-3358 and the zlib CVE-2022-37434 and found that Node.js does not call the affected code paths. The notice is an assessment only: it reports no attacker capability in Node.js itself.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":[],"affected":"","ecosystem":"node"}],"ecosystems":["node"],"tags":["node","runtime"],"not_affected_if":["default-node-usage"],"how_to_check":null,"fix":null,"status":"open","published_at":"2022-10-24T20:00:15+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:44+00:00","updated_at":"2026-10-25T05:41:44+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:41:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Node.js: OpenSSL and zlib flaws assessed as not reachable in Node.js","impact":"low","summary":"Node.js's security team reviewed the October 2022 OpenSSL CVE-2022-3358 and the zlib CVE-2022-37434 and found that Node.js does not call the affected code paths. The notice is an assessment only: it reports no attacker capability in Node.js itself.","category":"runtime","nicknames":[],"who_cares":["node","runtime"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["default-node-usage"],"who_is_affected":"The sources state that Node.js does not call the affected OpenSSL cipher constructor or zlib inflateGetHeader, so the flaws are not reachable through Node.js. Teams running Node.js with their own native addons that call these APIs directly would need to look at their own code; the sources do not say whether such addons exist.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000609,"input_tokens":4040,"output_tokens":409,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2022':32B,38B,130C,168C,195C '-3358':33B,169C '-37434':39B,131C,196C '/forum/#!forum/nodejs-sec':339C '/nodejs/node/security/policy#security':311C '11':113C '13':140C '2022':29B,114C,141C,372C '23rd':371C '50':230C 'activ':119C 'address':246C 'advisori':153C 'affect':48B,117C,144C,184C,218C 'aim':244C,256C 'analysi':146C,188C 'and':15A 'announc':329C 'announcement-on':328C 'assess':6A,9A,55B,86C,89C,98C,101C,149C,191C,229C,233C,269C,278C 'assessment':18A 'attack':60B 'autom':241C 'avail':74C,273C 'buffer':198C 'call':46B,173C,212C 'capabl':61B 'cipher':158C,175C 'code':49B 'commerci':64C 'contact':296C 'creat':239C 'current':301C 'custom':157C 'cve':31B,37B,129C,167C,194C,250C 'date':344C 'depend':227C,253C,263C 'doesn':171C,210C 'ecosystem':78C 'encrypt':166C 'ensur':284C 'evp':174C 'extra':207C 'field':208C 'found':41B,307C 'futur':298C 'gap':260C 'github':362C 'github.com':310C 'github.com/nodejs/node/security/policy#security':309C 'gonzaga':93C 'groups.google.com':338C 'groups.google.com/forum/#!forum/nodejs-sec':337C 'gzip':205C 'header':206C 'includ':312C 'inflat':201C 'inflategethead':213C 'inform':223C,313C 'initi':255C 'interest':292C 'issu':283C 'larg':204C 'lead':163C 'line':122C 'list':335C 'low':326C 'low-volum':325C 'lts':71C 'made':280C 'mail':334C 'maintain':358C 'mainten':70C 'may':162C 'meth':176C 'new':177C 'next':369C 'nid':160C,178C 'node':19A,20B 'node.js':1A,8A,22B,43B,63B,88C,100C,120C,145C,170C,181C,209C,215C,231C,236C,252C,268C,302C,321C,354C,361C 'nodej':226C,332C 'nodejs':13A 'nodejs-dependency-vuln-assess':225C 'nodejs-sec':331C 'nodejs/nodejs-dependency-vuln-assessments':275C 'notic':52B 'novemb':366C 'null':165C 'oct':112C,139C 'octob':28B 'openj':77C 'openssl':2A,14A,30B,82C,94C,108C,147C,365C 'organ':363C 'overflow':199C 'partner':81C 'past':68C 'patch':132C,295C 'path':50B 'phase':72C 'polici':304C 'previous':364C 'program':80C 'project':357C 'public':249C 'rafael':92C 'reduc':258C 'relat':351C 'releas':110C,121C,137C,265C,352C,368C,374C 'report':58B,317C 'repositori':271C,288C 'review':26B 'rg':91C 'runtim':21B 'sec':333C 'secur':24B,109C,136C,152C,237C,264C,294C,303C,346C,350C,367C,373C 'security-rel':349C 'see':224C 'septemb':370C 'stay':341C 'subscrib':322C 'summari':103C 'support':65C 'sustain':79C 'team':25B,238C 'therefor':180C,214C 'undef':161C,179C 'updat':5A,85C,97C,299C 'use':155C 'version':67C 'via':202C 'vnd':12A 'vnd-nodejs-openssl-and-zlib-vulnerability-assessment':11A 'volum':327C 'vuln':228C 'vulner':105C,128C,187C,221C,232C,319C,347C 'vulnerability':17A 'watch':286C 'well':124C 'workflow':10A,90C,102C,234C,242C 'zlib':4A,16A,36B,84C,96C,127C,135C,189C","nicknames":[],"mitigations":[],"who_affected":"The sources state that Node.js does not call the affected OpenSSL cipher constructor or zlib inflateGetHeader, so the flaws are not reachable through Node.js. Teams running Node.js with their own native addons that call these APIs directly would need to look at their own code; the sources do not say whether such addons exist.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-10-24T20:00:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"openssl-and-zlib-vulnerability-assessment","url":"https://nodejs.org/en/blog/vulnerability/openssl-and-zlib-vulnerability-assessment","severity":"low","published_at":"2022-10-24T20:00:15+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T15:55:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}