Node.js Vulnerabilities - Critical Updates Released

The Flaw

On March 24, 2026, Node.js issued a security advisory (AV26-277) highlighting vulnerabilities in several versions of its software. This advisory covers Node.js 20, Node.js 22, Node.js 24, and Node.js 25. The vulnerabilities affect versions prior to specific updates, which could expose applications to security risks.

The affected versions include:

• Node.js 20 – prior to v20.20.2 (LTS)
• Node.js 22 – prior to v22.22.2 (LTS)
• Node.js 24 – prior to v24.14.1 (LTS)
• Node.js 25 – prior to v25.8.2 (Current)

What's at Risk

These vulnerabilities could allow attackers to exploit weaknesses in applications built on these Node.js versions. The potential impact includes unauthorized access, data breaches, or service disruptions. Given the widespread use of Node.js in web applications, the risk is significant.

Organizations that rely on these versions should act quickly. Failing to update may leave systems vulnerable to attacks that could compromise sensitive data or disrupt services.

Patch Status

The Node.js team has released updates to address these vulnerabilities. Users are advised to upgrade to the following versions:

• Node.js 20.20.2 (LTS)
• Node.js 22.22.2 (LTS)
• Node.js 24.14.1 (LTS)
• Node.js 25.8.2 (Current)

These updates are crucial for maintaining security and stability within applications. The Cyber Centre emphasizes the importance of applying these updates promptly.

Immediate Actions

To protect against these vulnerabilities, users and administrators should:

1. Review the advisory and the linked resources for detailed information.
2. Upgrade to the latest versions of Node.js as specified.
3. Monitor systems for any unusual activity following the updates.

By taking these actions, organizations can mitigate risks associated with these vulnerabilities and ensure their applications remain secure.