{"id":"VND-nodejs-updates-cve-for-end-of-life","kind":"vulnerability","aliases":[],"related":["CVE-2025-23087","CVE-2025-23088","CVE-2025-23089"],"title":"Node.js: Updates on CVE for End-of-Life Versions","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners Updates on CVE for End-of-Life Versions RG Rafael Gonzaga Updates on CVE for End-of-Life Versions Update on the issuance of CVEs to mark End-of-Life Node.js Versions\nTL;DR: CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to\ntag EOL versions have been rejected by the CVE Program.\nThe Node.js team has, therefore, decided to update previous vulnerability specific\nCVEs to cover EOL releases, reflecting their ongoing security risks. This means that\nall new CVEs issued will include EOL releases in the applicability until we have specific\ninformation that indicates a CVE does not apply to an EOL release line. The project\ndoes not plan to evaluate CVEs against EOL lines but information provided to the\nproject may be used to update the applicability if/when it is available.\nOn January 21, 2025, Node.js released security patches for four active release\nlines. At the same time, CVEs were assigned to cover EOL (end-of-life) versions:\nCVE-2025-23087: Applies to Node.js v17 and all earlier versions (including v0.x).\nCVE-2025-23088: Applies to Node.js v19.\nCVE-2025-23089: Applies to Node.js v21.\nFor more details, refer to the original announcement: Node.js Vulnerability Announcement .\nWhy Node.js Does Not Evaluate EOL Versions\nDue to resource constraints, Node.js does not assess security reports for EOL\nreleases or include them in regular CVE version ranges. With over 20 EOL\nversions—each with different dependencies, build processes, and\nplatform support—comprehensive vulnerability assessments are not feasible.\nLimiting reviews to a subset of EOL versions could lead to inaccuracies, as\nvulnerabilities may appear differently based on underlying components like OpenSSL.\nThus, the focus remains on actively supported releases.\n"Why did the Node.js project issue a CVE for all EOL releases? Because we\ndon’t have the resources to evaluate every single past release to know which\nare vulnerable. Node.js is run by volunteers. We have sufficient funding to\nmaintain current releases, but not beyond that. In other words, all past Node.js\nreleases are vulnerable or will soon be. This CVE highlights that risk for your\norganization."\n— Matteo Collina ( Source )\nPurpose of Issuing These CVEs\nSecurity scanners in production environments trigger alerts when an active\nNode.js version is flagged as vulnerable, prompting an upgrade. If an EOL\nversion is not listed as affected, users might mistakenly consider their setup\nsecure. The Node.js Technical Steering Committee (TSC) noted that outdated\nversions, such as Node.js v16 (which, despite being EOL for over a year, still\nsees 11 million downloads per month), continue to be widely used.\nAssigning CVEs to EOL versions directly communicates the associated security\nrisks to organizations.\nRecent CVE Updates\nFollowing consultations with the CVE Program, HackerOne, and Node.js, further\nupdates were made to these CVEs:\nThe MITRE Top-Level Root tagged the CVEs with "unsupported when assigned" and marked them as "disputed" since they do not pinpoint a specific vulnerability.\nA note has been added indicating that using the CVE List to report an unsupported product is a new approach under review.\nUltimately, the CVE Board decided that these CVE Records should be rejected\ngiven the current CNA Operational Rules. However, this decision does not\ndetermine the long-term stance of the CVE Program on EOL support.\nThe Board will continue discussing potential solutions for managing EOL\nversions, and is collecting feedback from the community.\nTherefore, the only viable solution to reflect the risk of running and EOL\nline is to update previous CVEs to cover EOL releases, reflecting\ntheir ongoing security risks. The process is being tracked in\nnodejs/security-wg#1443 .\nQuestions and Feedback\nWe understand that upgrading may require effort, and we’re here to help. If you have\nany questions or need assistance, please reach out to us via:\nNode.js Help Repository\nFor organizations or developers who require continued use of EOL Node.js versions,\nthe OpenJS Ecosystem Sustainability Program\nprovides commercial support options.\nThank you for your attention to this important matter. Previous Node.js Test CI Security Incident Next Tuesday, January 21, 2025 Security Releases","summary":"Node.js is re-issuing previously assigned CVEs so they also apply to end-of-life release lines such as v17 and earlier, v19 and v21, which no longer receive security patches. The advisory does not describe a new code flaw; it states that all past EOL releases should be treated as vulnerable or soon to be.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":[],"affected":"","ecosystem":"node"}],"ecosystems":["node"],"tags":["ci","docker","node","runtime","self-hosted"],"not_affected_if":["active-lts","current-release"],"how_to_check":"- Run `node --version` on every host and container to find any EOL release line (anything past Maintenance LTS, e.g. v16, v17, v19, v21).\n- Check the Node.js release schedule at https://nodejs.org/en/about/releases for the end-of-life date of each line found.\n- Look at base images in Dockerfiles and CI config for pinned Node major versions.","fix":"- Move every EOL Node.js line to a currently supported release line, per the Node.js release schedule.\n- If an upgrade cannot happen yet, buy commercial support through the OpenJS Ecosystem Sustainability Program, as the advisory suggests.","status":"open","published_at":"2025-03-07T16:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:39:27+00:00","updated_at":"2026-10-25T05:39:27+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:39:27Z","model":"claude-haiku-5-5","output":{"fix":"- Move every EOL Node.js line to a currently supported release line, per the Node.js release schedule.\n- If an upgrade cannot happen yet, buy commercial support through the OpenJS Ecosystem Sustainability Program, as the advisory suggests.","reach":"unknown","title":"Node.js: CVEs now cover end-of-life release lines, not patched","impact":"medium","summary":"Node.js is re-issuing previously assigned CVEs so they also apply to end-of-life release lines such as v17 and earlier, v19 and v21, which no longer receive security patches. The advisory does not describe a new code flaw; it states that all past EOL releases should be treated as vulnerable or soon to be.","category":"runtime","nicknames":[],"who_cares":["node","self-hosted","ci","docker"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown; the advisory does not state a concrete exploit path for EOL lines","analyst_note":"Confirm which underlying CVEs (CVE-2025-23087, CVE-2025-23088, CVE-2025-23089) and their original impact apply; see https://nodejs.org/en/blog/vulnerability/updates-cve-for-end-of-life and the Node.js security-wg issue nodejs/security-wg#1443.","how_to_check":"- Run `node --version` on every host and container to find any EOL release line (anything past Maintenance LTS, e.g. v16, v17, v19, v21).\n- Check the Node.js release schedule at https://nodejs.org/en/about/releases for the end-of-life date of each line found.\n- Look at base images in Dockerfiles and CI config for pinned Node major versions.","needs_analyst":true,"not_affected_if":["active-lts","current-release"],"who_is_affected":"Any team running an end-of-life Node.js release in production, staging or build pipelines is affected by the flagged CVE records, and security scanners will report them. Teams already on active or Maintenance LTS lines are not affected by these EOL-applicability CVEs; the advisory says the project does not evaluate EOL lines, so the exact fixed-version boundary for each CVE on EOL lines is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00087,"input_tokens":4761,"output_tokens":787,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':140C,143C,147C,270C,283C,290C '-23087':141C,271C '-23088':144C,284C '-23089':148C,291C '11':521C '1443':700C '20':337C '2025':244C '21':243C 'activ':251C,383C,471C 'add':593C 'advisori':62B 'affect':489C 'alert':468C 'also':38B 'announc':303C,306C 'appear':370C 'appli':39B,207C,272C,285C,292C 'applic':195C,236C 'approach':608C 'assess':321C,351C 'assign':34B,260C,531C,575C 'associ':539C 'avail':94C,240C 'base':372C 'beyond':431C 'board':614C,648C 'build':344C 'ci':21B 'cna':626C 'code':68B 'collect':660C 'collina':455C 'commerci':84C 'committe':501C 'communic':537C 'communiti':664C 'compon':375C 'comprehens':349C 'consid':493C 'constraint':317C 'consult':548C 'continu':526C,650C 'could':363C 'cover':174C,262C,685C 'current':427C,625C 'cve':4A,15A,104C,116C,139C,142C,146C,159C,204C,269C,282C,289C,332C,393C,447C,545C,551C,598C,613C,618C,642C 'cves':35B,128C,172C,187C,220C,258C,461C,532C,562C,571C,683C 'decid':166C,615C 'decis':631C 'depend':343C 'describ':65B 'despit':512C 'detail':298C 'determin':634C 'differ':342C,371C 'direct':536C 'discuss':651C 'disput':580C 'docker':22B 'download':523C 'dr':138C 'due':314C 'earlier':51B,278C 'ecosystem':98C 'effort':710C 'end':7A,17A,42B,107C,119C,132C,265C 'end-of-lif':6A,41B,106C,118C,131C,264C 'environ':466C 'eol':75B,152C,175C,191C,210C,222C,263C,312C,325C,338C,361C,396C,483C,514C,534C,645C,656C,677C,686C 'evalu':219C,311C,406C 'everi':407C 'feasibl':354C 'feedback':661C,703C 'flag':475C 'flaw':69B 'focus':380C 'follow':547C 'for':16A 'four':250C 'fund':424C 'given':623C 'gonzaga':113C 'hackeron':553C 'hel':716C 'highlight':448C 'host':27B 'howev':629C 'if/when':237C 'inaccuraci':366C 'includ':190C,280C,328C 'indic':202C,594C 'inform':200C,225C 'issu':32B,149C,188C,391C,459C 'issuanc':126C 'januari':242C 'know':412C 'lead':364C 'level':567C 'life':9A,19A,44B,109C,121C,134C,267C 'like':376C 'limit':355C 'line':46B,212C,223C,253C,678C 'list':487C,599C 'long':637C 'long-term':636C 'longer':57B 'lts':91C 'made':559C 'maintain':426C 'mainten':90C 'manag':655C 'mark':130C,577C 'matteo':454C 'may':230C,369C,708C 'mean':183C 'might':491C 'million':522C 'mistaken':492C 'mitr':564C 'month':525C 'new':67B,186C,607C 'node':20A,23B 'node.js':1A,28B,135C,162C,245C,274C,287C,294C,304C,308C,318C,389C,416C,438C,472C,498C,509C,555C 'nodejs':13A 'nodejs/security-wg':699C 'note':503C,590C 'of':18A 'ongo':179C,690C 'openj':97C 'openssl':377C 'oper':627C 'organ':453C,543C 'origin':302C 'outdat':505C 'partner':101C 'past':74B,88C,409C,437C 'patch':60B,248C 'per':524C 'phase':92C 'pinpoint':585C 'plan':217C 'platform':347C 'potenti':652C 'previous':33B,169C,682C 'process':345C,694C 'product':465C,604C 'program':100C,160C,552C,643C 'project':214C,229C,390C 'prompt':478C 'provid':226C 'purpos':457C 'question':701C 'rafael':112C 'rang':334C 're':31B,713C 're-issu':30B 'receiv':58B 'recent':544C 'record':619C 'refer':299C 'reflect':177C,671C,688C 'regular':331C 'reject':156C,622C 'releas':45B,76B,176C,192C,211C,246C,252C,326C,385C,397C,410C,428C,439C,687C 'remain':381C 'report':323C,601C 'requir':709C 'resourc':316C,404C 'review':356C,610C 'rg':111C 'risk':181C,450C,541C,673C,692C 'root':568C 'rule':628C 'run':418C,675C 'runtim':24B 'scanner':463C 'secur':59B,180C,247C,322C,462C,496C,540C,691C 'see':520C 'self':26B 'self-host':25B 'setup':495C 'sinc':581C 'singl':408C 'solut':653C,669C 'soon':83B,444C 'sourc':456C 'specif':171C,199C,587C 'stanc':639C 'state':71B 'steer':500C 'still':519C 'subset':359C 'suffici':423C 'support':85C,348C,384C,646C 'sustain':99C 'tag':151C,569C 'team':163C 'technic':499C 'term':638C 'therefor':165C,665C 'thus':378C 'time':257C 'tl':137C 'top':566C 'top-level':565C 'track':697C 'treat':79B 'trigger':467C 'tsc':502C 'ultim':611C 'under':374C 'understand':705C 'unsupport':573C,603C 'updat':2A,102C,114C,123C,168C,234C,546C,557C,681C 'updates':14A 'upgrad':480C,707C 'use':232C,530C,596C 'user':490C 'v0.x':281C 'v16':510C 'v17':49B,275C 'v19':52B,288C 'v21':54B,295C 'version':10A,87C,110C,122C,136C,153C,268C,279C,313C,333C,339C,362C,473C,484C,506C,535C,657C 'viabl':668C 'vnd':12A 'vnd-nodejs-updates-cve-for-end-of-life':11A 'volunt':420C 'vulner':81B,170C,305C,350C,368C,415C,441C,477C,588C 'wide':529C 'word':435C 'year':518C","nicknames":[],"mitigations":[],"who_affected":"Any team running an end-of-life Node.js release in production, staging or build pipelines is affected by the flagged CVE records, and security scanners will report them. Teams already on active or Maintenance LTS lines are not affected by these EOL-applicability CVEs; the advisory says the project does not evaluate EOL lines, so the exact fixed-version boundary for each CVE on EOL lines is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-07T16:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"updates-cve-for-end-of-life","url":"https://nodejs.org/en/blog/vulnerability/updates-cve-for-end-of-life","severity":null,"published_at":"2025-03-07T16:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-26T07:40:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}