oss-security - Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0a34f769-2a8d-4726-b9d7-6238ec3846e7@oracle.com>
Date: Fri, 24 Jan 2025 10:55:39 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089

On 1/21/25 12:12, Jan Schaumann wrote:
> [Forwarding here because I seem to recall that the
> NodeJS team doesn't usually post their announcements
> to this list; I have no other affiliation with
> NodeJS.]
> 
> https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
> 
> Tuesday, January 21, 2025 Security Releases
> 
> Security releases available
> 
> Updates are now available for the 23.x, 22.x, 20.x,
> 18.x Node.js release lines for the following issues.

They've also listed on this page some unusual CVE's:

Along with the security fixes, the Node.js team has also issued CVEs for 
End-of-Life (EOL) versions of Node.js.

    - Node.js v17.x or prior CVE-2025-23087
    - Node.js v19.x CVE-2025-23088
    - Node.js v21.x CVE-2025-23089

where the CVE description is just:

   This CVE has been issued to inform users that they are using End-of-Life (EOL)
   versions of Node.js. These versions are no longer supported and do not receive
   updates, including security patches. The continued use of EOL versions may
   expose systems to potential security risks due to unaddressed software
   vulnerabilities or dependencies (CWE-1104: Use of Unmaintained Third-Party
   Components). Users are advised to upgrade to actively supported versions of
   Node.js to ensure continued security updates and support.

Their reasons for this are detailed on the blog post at:
https://nodejs.org/en/blog/vulnerability/upcoming-cve-for-eol-versions
including getting CVE scanners to report EOL versions as vulnerable even
if no existing CVE specifically says that they are.

While I can understand their reasoning, I can just imagine the noise if
every project started issuing CVE's for every version that reaches EOL.

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.