Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 1/21/25 12:12, Jan Schaumann wrote:
> [Forwarding here because I seem to recall that the
> NodeJS team doesn't usually post their announcements
> to this list; I have no other affiliation with
> NodeJS.]
>
> https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
>
> Tuesday, January 21, 2025 Security Releases
>
> Security releases available
>
> Updates are now available for the 23.x, 22.x, 20.x,
> 18.x Node.js release lines for the following issues.

They've also listed on this page some unusual CVE's:

Along with the security fixes, the Node.js team has also issued CVEs for 
End-of-Life (EOL) versions of Node.js.

   - Node.js v17.x or prior CVE-2025-23087
   - Node.js v19.x CVE-2025-23088
   - Node.js v21.x CVE-2025-23089

where the CVE description is just:

  This CVE has been issued to inform users that they are using End-of-Life (EOL)
  versions of Node.js. These versions are no longer supported and do not receive
  updates, including security patches. The continued use of EOL versions may
  expose systems to potential security risks due to unaddressed software
  vulnerabilities or dependencies (CWE-1104: Use of Unmaintained Third-Party
  Components). Users are advised to upgrade to actively supported versions of
  Node.js to ensure continued security updates and support.

Their reasons for this are detailed on the blog post at:
https://nodejs.org/en/blog/vulnerability/upcoming-cve-for-eol-versions
including getting CVE scanners to report EOL versions as vulnerable even
if no existing CVE specifically says that they are.

While I can understand their reasoning, I can just imagine the noise if
every project started issuing CVE's for every version that reaches EOL.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris