---
id: "VND-nodejs-openssl-fixes-in-regular-releases-oct2023"
kind: "vulnerability"
aliases: []
title: "Node.js: OpenSSL Recent Security Patches"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "node", "fixed": [], "affected": "", "ecosystem": "node"}]
ecosystems: ["node"]
tags: ["node", "runtime", "windows"]
not_affected_if: ["linux-only", "macos-only", "no-native-addons-calling-openssl"]
published_at: "2023-10-26T17:00:15+00:00"
first_seen_at: "2026-10-23T19:13:00+00:00"
updated_at: "2026-10-25T05:41:35+00:00"
sources: [{"source": "nodejs", "url": "https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-oct2023", "first_seen_at": "2026-10-23T19:13:00+00:00"}]
---

# Node.js: OpenSSL Recent Security Patches

Node.js bundles OpenSSL, and OpenSSL 3.0.11 and 3.0.12 fixed CVE-2023-4807, where the POLY1305 MAC implementation corrupts XMM registers on Windows. Node.js rates the flaw LOW and ships the fix in regular Node.js releases; the Node.js team says CVE-2023-5363 does not affect it because Node.js does not use the affected functions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- node:node affected ? fixed ?

## How to check

- Run `node --version` and compare it with the fixed release listed in the Node.js advisory.
- Run `node -p process.versions.openssl` to see the bundled OpenSSL version.
- Check whether native addons call EVP_EncryptInit_ex2, EVP_DecryptInit_ex2 or EVP_CipherInit_ex2 directly.

## Fix

- Upgrade Node.js on Windows to a regular release that includes OpenSSL 3.0.12 or later, once it is published.
- Native addons that call the affected OpenSSL functions can link against a patched system OpenSSL until a new Node.js release is available.

## Timeline

- 2026-10-23T19:13:00+00:00 nodejs https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-oct2023

## From the sources

Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners OpenSSL Recent Security Patches RG Rafael Gonzaga OpenSSL Recent Security Patches Summary
For the vulnerabilities disclosed in the OpenSSL Security Advisories of:
OpenSSL 3.0.11 - Tuesday 19th September 2023
OpenSSL 3.0.12 - Tuesday 24th October 2023
Node.js (Windows) is affected by one vulnerability rated as LOW.
Therefore, these patches will be released in regular Node.js releases.
Analysis
Our assessment of the following security advisories:
OpenSSL 3.0.11
OpenSSL 3.0.12
is:
POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807) - Low
Node.js is affected by this vulnerability. The CVE-2023-4807
affects Windows users, and the vulnerability is rated as LOW by the OpenSSL
Security Team.
Incorrect cipher key & IV length processing (CVE-2023-5363) - Moderate
Node.js doesn't make use or export EVP_EncryptInit_ex2() , EVP_DecryptInit_ex2() or
EVP_CipherInit_ex2() functions. Node.js is not affected.
Users who call the affected OpenSSL functions through other means,
such as through native addons, can dynamically link against a patched version of OpenSSL
until new releases of Node.js are available.
Contact and future updates
The current Node.js security policy can be found at https://github.com/nodejs/node/security/policy#security ,
including information on how to report a vulnerability in Node.js.
Subscribe to the low-volume announcement-only nodejs-sec mailing list at
https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on
security vulnerabilities and security-related releases of Node.js and the
projects maintained in the
nodejs GitHub organization . Previous Wednesday February 14 2024 Security Releases Next Friday October 13 2023 Security Releases

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_