From 813902af0117e1627de9ba7c2fc2ae345392b360 Mon Sep 17 00:00:00 2001 From: Matteo Collina Date: Sun, 8 Jun 2025 13:28:40 +0200 Subject: [PATCH 1/2] Final touches on EOL article Signed-off-by: Matteo Collina --- .../en/blog/announcements/node-18-eol-support.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/apps/site/pages/en/blog/announcements/node-18-eol-support.md b/apps/site/pages/en/blog/announcements/node-18-eol-support.md index 8b9e6601c4ce4..e72444b123b0e 100644 --- a/apps/site/pages/en/blog/announcements/node-18-eol-support.md +++ b/apps/site/pages/en/blog/announcements/node-18-eol-support.md @@ -23,13 +23,16 @@ Many ask, “**Why does the Node.js project not fix vulnerabilities for all rele If you are looking for additional proof points, here are a few examples of vulnerabilities that older versions of [Node.js](http://Node.js) are impacted: - [https://nvd.nist.gov/vuln/detail/CVE-2025-23167](https://nvd.nist.gov/vuln/detail/CVE-2025-23167) affects 18, 16, 14 (llhttp) \- medium -- [https://nvd.nist.gov/vuln/detail/CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) affects 16 e 14 (openssl) \- medium -- [https://nvd.nist.gov/vuln/detail/CVE-2024-22019](https://nvd.nist.gov/vuln/detail/CVE-2024-22019) affects 16 e 14 (llhttp) \- high +- [https://nvd.nist.gov/vuln/detail/CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) affects 16, 14 (openssl) \- medium +- [https://nvd.nist.gov/vuln/detail/CVE-2024-22019](https://nvd.nist.gov/vuln/detail/CVE-2024-22019) affects 16, 14 (llhttp) \- high - [https://nvd.nist.gov/vuln/detail/CVE-2021-39135](https://nvd.nist.gov/vuln/detail/CVE-2021-39135) affects 14 (npm) \- high -This affects a staggering number of projects. Based on download statistics, Node.js v18 still accounts for approximately **50 million monthly downloads**, while legacy versions (v16 and below) continue to see **tens of millions of downloads per month**. That represents countless applications running on known vulnerable, unsupported runtime environments. +This affects a staggering number of projects. Based on download statistics, Node.js v18 still accounts for approximately **50 million monthly downloads**, while legacy versions (v18 and below) continue to see **tens of millions of downloads per month**. That represents countless applications running on known vulnerable, unsupported runtime environments. -\[suggested paragraph on [GitHub \- nodejs/is-my-node-vulnerable: package that checks if your Node.js installation is vulnerable to known security vulnerabilities](https://github.com/nodejs/is-my-node-vulnerable)\] +You can check if your Node.js installation is vulnerable to known security +vulnerabilities using the [is-my-node-vulnerable](https://github.com/nodejs/is-my-node-vulnerable) +package. This tool checks your Node.js version against a database of known +vulnerabilities and provides guidance on whether you need to upgrade. ## Node.js v22: The Smart Long-Term Choice From ea3b62b8588e819b0fd054e72416babb2b0124c0 Mon Sep 17 00:00:00 2001 From: Matteo Collina Date: Sun, 8 Jun 2025 13:49:30 +0200 Subject: [PATCH 2/2] Update apps/site/pages/en/blog/announcements/node-18-eol-support.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Matteo Collina --- apps/site/pages/en/blog/announcements/node-18-eol-support.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/site/pages/en/blog/announcements/node-18-eol-support.md b/apps/site/pages/en/blog/announcements/node-18-eol-support.md index e72444b123b0e..dae417019c8fe 100644 --- a/apps/site/pages/en/blog/announcements/node-18-eol-support.md +++ b/apps/site/pages/en/blog/announcements/node-18-eol-support.md @@ -27,7 +27,7 @@ If you are looking for additional proof points, here are a few examples of vulne - [https://nvd.nist.gov/vuln/detail/CVE-2024-22019](https://nvd.nist.gov/vuln/detail/CVE-2024-22019) affects 16, 14 (llhttp) \- high - [https://nvd.nist.gov/vuln/detail/CVE-2021-39135](https://nvd.nist.gov/vuln/detail/CVE-2021-39135) affects 14 (npm) \- high -This affects a staggering number of projects. Based on download statistics, Node.js v18 still accounts for approximately **50 million monthly downloads**, while legacy versions (v18 and below) continue to see **tens of millions of downloads per month**. That represents countless applications running on known vulnerable, unsupported runtime environments. +This affects a staggering number of projects. Based on download statistics, Node.js v18, the most recent End-of-Life version, still accounts for approximately **50 million monthly downloads**, while earlier legacy versions (v16 and below) continue to see **tens of millions of downloads per month**. That represents countless applications running on known vulnerable, unsupported runtime environments. You can check if your Node.js installation is vulnerable to known security vulnerabilities using the [is-my-node-vulnerable](https://github.com/nodejs/is-my-node-vulnerable)