{"id":"VND-nodejs-upcoming-cve-for-eol-versions","kind":"vulnerability","aliases":[],"related":[],"title":"Node.js: Upcoming CVE for End-of-Life Node.js Versions","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners Upcoming CVE for End-of-Life Node.js Versions TNJP The Node.js Project Upcoming CVE for End-of-Life Node.js Versions The Node.js Project is committed to ensuring the security and reliability of\napplications built on Node.js. As part of this commitment, we regularly review\nmeasures to help our users stay informed about security risks.\nAnnouncement\nWe will soon issue a Common Vulnerabilities and Exposures (CVE) identifier for\nEnd-of-Life (EOL) versions of Node.js. This CVE will serve as an official\nnotification to inform users that these versions are no longer maintained and\nmay pose significant security risks.\nThe CVE will cite Unsupported When Assigned under\nCWE-1104 : Use of Unmaintained Third Party Components .\nFor more details on this decision, you can refer to the discussion in\nthis GitHub issue .\nWhy Issue a CVE?\nMany organizations rely on CVE notifications to track security issues across\ntheir software stacks. The Node.js project aims for a timely resolution and disclosure\nfor all reported vulnerabilities for the maintained release lines.\nHowever, we do not issue CVEs for EOL release lines.\nBy issuing a CVE for EOL versions of Node.js, we aim to:\nRaise Awareness: Inform users that running EOL versions exposes their\napplications to potential vulnerabilities.\nEncourage Upgrades: Prompt organizations and developers to update to\nactively supported Node.js versions.\nImprove Security: Reduce the number of applications running outdated and\nunsupported versions of Node.js.\nNode.js v16, despite being EOL for over a year, has still 11 million downloads per month.\nWhat Does This Mean for You?\nIf you are using an EOL version of Node.js, we strongly encourage you to upgrade\nto a supported version immediately. You can find the list of actively supported\nversions and their maintenance schedules in the Node.js Release Schedule .\nTo check which version of Node.js your application is running, execute the\nfollowing command in your terminal:\nnode -v\nYou can also run is-my-node-vulnerable\nto check if you are using an EOL version or any version with an CVE issued to it.\nnpx is-my-node-vulnerable\nSupported Versions\nAs of the date of this announcement, the following versions are actively supported:\nNode.js 23 (Current)\nNode.js 22 (LTS)\nNode.js 20 (Maintenance LTS)\nNode.js 18 (Maintenance LTS)\nAll other versions are no longer supported and should be considered deprecated.\nQuestions and Feedback\nWe understand that upgrading may require effort, and we’re here to help. If you have\nany questions or need assistance, please reach out to us via:\nNode.js Help Repository\nFor organizations or developers who require continued use of EOL Node.js versions,\nthe OpenJS Ecosystem Sustainability Program\nprovides commercial support options.\nThank you for your attention to this important matter. Previous Tuesday, January 21, 2025 Security Releases Next Monday, July 8, 2024 Security Releases","summary":"The Node.js project will issue a CVE identifier for end-of-life Node.js versions, citing CWE-1104 (use of unmaintained third-party components), to tell users those versions no longer receive security fixes. No new code flaw is described, so an attacker gains nothing new from this notice itself; the risk is running unpatched EOL releases.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":[],"affected":"","ecosystem":"node"}],"ecosystems":["node"],"tags":["ci","containers","node","node.js","runtime","self-hosted"],"not_affected_if":["supported-release-line"],"how_to_check":"- Run `node -v` on each server, container and CI runner and compare against the supported lines listed in the notice (23 Current, 22 LTS, 20 and 18 Maintenance LTS).\n- Run `npx is-my-node-vulnerable` to flag EOL versions or versions with an issued CVE.","fix":"- Move any Node.js build that is not 23, 22, 20 or 18 to a supported release line, such as `22` (LTS), and retest.\n- For EOL versions that must stay, the notice points to commercial support through the OpenJS Ecosystem Sustainability Program.","status":"open","published_at":"2025-01-06T16:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:39:32+00:00","updated_at":"2026-10-25T05:39:32+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:39:32Z","model":"claude-haiku-5-5","output":{"fix":"- Move any Node.js build that is not 23, 22, 20 or 18 to a supported release line, such as `22` (LTS), and retest.\n- For EOL versions that must stay, the notice points to commercial support through the OpenJS Ecosystem Sustainability Program.","reach":"unknown","title":"Node.js: upcoming CVE will flag end-of-life release lines as unmaintained","impact":"low","summary":"The Node.js project will issue a CVE identifier for end-of-life Node.js versions, citing CWE-1104 (use of unmaintained third-party components), to tell users those versions no longer receive security fixes. No new code flaw is described, so an attacker gains nothing new from this notice itself; the risk is running unpatched EOL releases.","category":"runtime","nicknames":[],"who_cares":["node.js","self-hosted","containers","ci"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unpatched EOL runtime accumulates unfixed security flaws over time","analyst_note":"Confirm the CVE identifier and publication date once issued; source gives no version-specific flaw, so check the Node.js security blog for the assigned ID at https://nodejs.org/en/blog/vulnerability/upcoming-cve-for-eol-versions.","how_to_check":"- Run `node -v` on each server, container and CI runner and compare against the supported lines listed in the notice (23 Current, 22 LTS, 20 and 18 Maintenance LTS).\n- Run `npx is-my-node-vulnerable` to flag EOL versions or versions with an issued CVE.","needs_analyst":true,"not_affected_if":["supported-release-line"],"who_is_affected":"Any application or service running an end-of-life Node.js version is affected, because those lines will no longer get security fixes and will be flagged with a CVE. The notice names Node.js 16 as still widely downloaded. Teams already on Node.js 18 or newer supported lines can skip it, though 18 is in Maintenance LTS and also needs watching.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000793,"input_tokens":4273,"output_tokens":732,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1104':45B,214C '11':348C '18':475C '20':471C '2024':564C '2025':557C '21':556C '22':468C '23':465C '8':563C 'across':251C 'activ':319C,385C,462C 'aim':258C,294C 'also':418C 'announc':160C,457C 'applic':138C,306C,329C,404C 'assign':211C 'assist':513C 'attack':71B 'attent':548C 'avail':96C 'awar':297C 'built':139C 'check':398C,426C 'ci':20B 'cite':43B,208C 'code':65B 'command':410C 'commerci':86C,541C 'commit':130C,146C 'common':166C 'compon':52B,220C 'consid':488C 'contain':21B 'continu':529C 'current':466C 'cve':3A,15A,34B,105C,118C,170C,182C,206C,240C,245C,287C,439C 'cves':279C 'cwe':44B,213C 'date':454C 'decis':226C 'deprec':489C 'describ':68B 'despit':339C 'detail':223C 'develop':315C,526C 'disclosur':264C 'discuss':232C 'download':350C 'ecosystem':100C,537C 'effort':499C 'encourag':310C,370C 'end':6A,38B,108C,121C,174C 'end-of-lif':5A,37B,107C,120C,173C 'ensur':132C 'eol':17A,84B,177C,281C,289C,302C,341C,364C,432C,532C 'execut':407C 'expos':304C 'exposur':169C 'feedback':492C 'find':381C 'fix':62B 'flaw':66B 'follow':409C,459C 'for':16A 'gain':72B 'github':235C 'help':152C,505C,521C 'host':27B 'howev':274C 'identifi':35B,171C 'immedi':378C 'import':551C 'improv':323C 'inform':156C,190C,298C 'is-my-node-vulner':420C,444C 'issu':32B,164C,236C,238C,250C,278C,285C,440C 'januari':555C 'juli':562C 'life':8A,40B,110C,123C,176C 'line':273C,283C 'list':383C 'longer':59B,197C,483C 'lts':93C,469C,473C,477C 'maintain':198C,271C 'mainten':92C,390C,472C,476C 'mani':241C 'matter':552C 'may':200C,497C 'mean':356C 'measur':150C 'million':349C 'monday':561C 'month':352C 'need':512C 'new':64B,74B 'next':560C 'node':19A,22B,414C,423C,447C 'node.js':1A,9A,23B,29B,41B,111C,115C,124C,127C,141C,180C,256C,292C,321C,336C,337C,367C,394C,402C,464C,467C,470C,474C,520C,533C 'nodejs':13A 'noth':73B 'notic':77B 'notif':188C,246C 'npx':443C 'number':327C 'offici':187C 'openj':99C,536C 'option':543C 'organ':242C,313C,524C 'outdat':331C 'part':143C 'parti':51B,219C 'partner':103C 'past':90C 'per':351C 'phase':94C 'pleas':514C 'pose':201C 'potenti':308C 'previous':553C 'program':102C,539C 'project':30B,116C,128C,257C 'prompt':312C 'provid':540C 'question':490C,510C 'rais':296C 're':502C 'reach':515C 'receiv':60B 'reduc':325C 'refer':229C 'regular':148C 'releas':85B,272C,282C,395C,559C,566C 'reli':243C 'reliabl':136C 'report':267C 'repositori':522C 'requir':498C,528C 'resolut':262C 'review':149C 'risk':80B,159C,204C 'run':82B,301C,330C,406C,419C 'runtim':24B 'schedul':391C,396C 'secur':61B,134C,158C,203C,249C,324C,558C,565C 'self':26B 'self-host':25B 'serv':184C 'signific':202C 'softwar':253C 'soon':163C 'stack':254C 'stay':155C 'still':347C 'strong':369C 'support':87C,320C,376C,386C,449C,463C,484C,542C 'sustain':101C,538C 'tell':54B 'termin':413C 'thank':544C 'third':50B,218C 'third-parti':49B 'time':261C 'tnjp':113C 'track':248C 'tuesday':554C 'understand':494C 'unmaintain':48B,217C 'unpatch':83B 'unsupport':209C,333C 'upcom':2A,104C,117C 'upcoming':14A 'updat':317C 'upgrad':311C,373C,496C 'us':518C 'use':46B,215C,362C,430C,530C 'user':55B,154C,191C,299C 'v':415C 'v16':338C 'version':10A,42B,57B,89C,112C,125C,178C,194C,290C,303C,322C,334C,365C,377C,387C,400C,433C,436C,450C,460C,480C,534C 'versions':18A 'via':519C 'vnd':12A 'vnd-nodejs-upcoming-cve-for-eol-versions':11A 'vulner':167C,268C,309C,424C,448C 'year':345C","nicknames":[],"mitigations":[],"who_affected":"Any application or service running an end-of-life Node.js version is affected, because those lines will no longer get security fixes and will be flagged with a CVE. The notice names Node.js 16 as still widely downloaded. Teams already on Node.js 18 or newer supported lines can skip it, though 18 is in Maintenance LTS and also needs watching.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-01-06T16:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"upcoming-cve-for-eol-versions","url":"https://nodejs.org/en/blog/vulnerability/upcoming-cve-for-eol-versions","severity":null,"published_at":"2025-01-06T16:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T14:54:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}