11---
2- date : ' 2025-01-14T16 :00:00.000Z'
2+ date : ' 2025-01-06 :00:00.000Z'
33category : vulnerability
44title : Upcoming CVE for End-of-Life Node.js Versions
55layout : blog-post
@@ -18,24 +18,24 @@ notification to inform users that these versions are no longer maintained and
1818may pose significant security risks.
1919
2020The CVE will cite ** Unsupported When Assigned** under
21- [ CWE-1104] ( https://cwe.mitre.org/data/definitions/1104.html ) : * Use of Unmaintained Third Party Components * .
21+ [ CWE-1104] ( https://cwe.mitre.org/data/definitions/1104.html ) : _ Use of Unmaintained Third Party Components _ .
2222For more details on this decision, you can refer to the discussion in
2323[ this GitHub issue] ( https://github.com/nodejs/security-wg/issues/1401 ) .
2424
2525## Why Issue a CVE?
2626
2727Many organizations rely on CVE notifications to track security issues across
28- their software stacks. The Node.js project guarantee a timely resolution and disclosure
28+ their software stacks. The Node.js project aims for a timely resolution and disclosure
2929for all reported vulnerabilities for the _ maintained_ release lines.
3030However, we do not issue CVEs for EOL release lines.
3131By issuing a CVE for EOL versions of Node.js, we aim to:
3232
33- * ** Raise Awareness:** Inform users that running EOL versions exposes their
34- applications to potential vulnerabilities.
35- * ** Encourage Upgrades:** Prompt organizations and developers to update to
36- actively supported Node.js versions.
37- * ** Improve Security:** Reduce the number of applications running outdated and
38- unsupported versions of Node.js.
33+ - ** Raise Awareness:** Inform users that running EOL versions exposes their
34+ applications to potential vulnerabilities.
35+ - ** Encourage Upgrades:** Prompt organizations and developers to update to
36+ actively supported Node.js versions.
37+ - ** Improve Security:** Reduce the number of applications running outdated and
38+ unsupported versions of Node.js.
3939
4040> Node.js v16, despite being EOL for over a year, has still 11 million downloads per month.
4141
@@ -67,10 +67,10 @@ npx is-my-node-vulnerable
6767
6868As of the date of this announcement, the following versions are actively supported:
6969
70- * Node.js 23 (Current)
71- * Node.js 22 (LTS)
72- * Node.js 20 (Maintenance LTS)
73- * Node.js 18 (Maintenance LTS)
70+ - Node.js 23 (Current)
71+ - Node.js 22 (LTS)
72+ - Node.js 20 (Maintenance LTS)
73+ - Node.js 18 (Maintenance LTS)
7474
7575All other versions are no longer supported and should be considered deprecated.
7676
@@ -79,7 +79,7 @@ All other versions are no longer supported and should be considered deprecated.
7979We understand that upgrading may require effort, and we’re here to help. If you have
8080any questions or need assistance, please reach out to us via:
8181
82- * [ Node.js Help Repository] ( https://github.com/nodejs/help )
82+ - [ Node.js Help Repository] ( https://github.com/nodejs/help )
8383
8484For organizations or developers who require continued use of EOL Node.js versions,
8585the [ OpenJS Ecosystem Sustainability Program] ( https://nodejs.org/en/about/previous-releases#commercial-support )
0 commit comments