Node.js v24.4.1, v22.17.1 and v20.19.4 released!

[NewsBot]

Node.js v24.4.1, v22.17.1 and v20.19.4 has been released.

This is a security release.

Notable Changes

• (CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm
• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Commits

• [c33223f1a5] - (CVE-2025-27209) deps: V8: revert rapidhash commits (Michaël Zasso) nodejs-private/node-private#713
• [56f9db2aaa] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721

Link: Release 2025-07-15, Version 24.4.1 (Current), @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Commits

• [8cf5d66ab7] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721
• [9c0cb487ec] - win,build: fix MSVS v17.14 compilation issue (StefanStojanovic) #58902

Link: Release 2025-07-15, Version 22.17.1 'Jod' (LTS), @RafaelGSS · nodejs/node · GitHub

This is a security release.

Notable Changes

• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Commits

• [db7b93fcef] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721

Link: Release 2025-07-15, Version 20.19.4 'Iron' (LTS), @RafaelGSS · nodejs/node · GitHub