Skip to content

Commit 8f2a210

Browse files
shayan0v0nshayan0v0n
authored
Merge branch 'nodejs:main' into fix/search-footer-alignment
2 parents 0a587a6 + 5046ba5 commit 8f2a210

File tree

2 files changed

+84
-1
lines changed

2 files changed

+84
-1
lines changed

‎apps/site/pages/en/blog/release/v25.5.0.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ author: Antoine du Hamel
1212

1313
#### Streamlined building process of Single Executable Applications (SEA)
1414

15-
This release introduces a new `--build-sea` command-line flag that simplifies the process of building [Single Executable Applications (SEA)](https://nodejs.org/api/single-executable-application.html) using Node.js.
15+
This release introduces a new `--build-sea` command-line flag that simplifies the process of building [Single Executable Applications (SEA)](https://nodejs.org/api/single-executable-applications.html) using Node.js.
1616

1717
Previously, SEA generation involved copying the executable, generating the preparation blob with `--experimental-sea-config`, and injecting the blob into the copy using [nodejs/postject](https://github.com/nodejs/postject). With the new `--build-sea` flag, these steps are now consolidated into a single step available from Node.js core.
1818

‎apps/site/pages/en/blog/vulnerability/openssl-fixes-in-regular-releases-jan2026.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
date: '2026-01-28T17:00:00.000Z'
3+
category: vulnerability
4+
title: OpenSSL Security Advisory Assessment, January 2026
5+
layout: blog-post
6+
author: The Node.js Project
7+
---
8+
9+
## Summary
10+
11+
The OpenSSL project released a security advisory that includes 12 CVEs.
12+
After assessment, we have concluded that three CVEs affect Node.js (severity Low to Moderate).
13+
Given the limited attack surface, the OpenSSL updates will be included in
14+
upcoming regular Node.js releases rather than dedicated security releases.
15+
16+
## Analysis
17+
18+
All three vulnerabilities relate to how Node.js processes PFX (PKCS#12) certificate files,
19+
which are used when configuring TLS connections via the `pfx` option.
20+
An attacker would need to provide a specially crafted PFX file to trigger any of these issues.
21+
Since PFX files typically come from trusted local sources (e.g., your own private keys
22+
and certificates), the attack surface is limited in practice.
23+
24+
### CVE-2025-11187: Stack buffer overflow in PBMAC1 MAC verification - Moderate
25+
26+
| Branch | OpenSSL Version | Affected |
27+
| ------ | --------------- | -------- |
28+
| v20.x | 3.0.15 | No |
29+
| v22.x | 3.5.4 | Yes |
30+
| v24.x | 3.5.4 | Yes |
31+
| v25.x | 3.5.4 | Yes |
32+
| main | 3.5.4 | Yes |
33+
34+
OpenSSL 3.0 (used by v20.x) does not support PBMAC1 and is therefore not affected.
35+
36+
### CVE-2025-69421: NULL pointer dereference in PKCS12_item_decrypt_d2i_ex() - Low
37+
38+
| Branch | OpenSSL Version | Affected |
39+
| ------ | --------------- | -------- |
40+
| v20.x | 3.0.15 | Yes |
41+
| v22.x | 3.5.4 | Yes |
42+
| v24.x | 3.5.4 | Yes |
43+
| v25.x | 3.5.4 | Yes |
44+
| main | 3.5.4 | Yes |
45+
46+
This function is called internally by `PKCS12_parse()`. All branches are affected.
47+
48+
### CVE-2026-22795: Type confusion during PKCS#12 parsing - Low
49+
50+
| Branch | OpenSSL Version | Affected |
51+
| ------ | --------------- | -------- |
52+
| v20.x | 3.0.15 | Yes |
53+
| v22.x | 3.5.4 | Yes |
54+
| v24.x | 3.5.4 | Yes |
55+
| v25.x | 3.5.4 | Yes |
56+
| main | 3.5.4 | Yes |
57+
58+
Both OpenSSL 3.0 and 3.5 are vulnerable. All branches are affected.
59+
60+
## CVEs that do not affect Node.js
61+
62+
The following 9 CVEs do not affect Node.js on any branch:
63+
64+
- **CVE-2025-15467 (High, CMS AuthEnvelopedData):** Node.js does not use CMS APIs.
65+
- **CVE-2025-15468 (Low, SSL_CIPHER_find + QUIC):** Node.js never calls `SSL_CIPHER_find()`.
66+
- **CVE-2025-15469 (Low, openssl dgst truncation):** Command-line tool only.
67+
- **CVE-2025-66199 (Low, TLS 1.3 CompressedCertificate):** Node.js builds with `OPENSSL_NO_COMP` on all branches, so certificate compression is disabled.
68+
- **CVE-2025-68160 (Low, BIO_f_linebuffer):** Node.js does not use this BIO filter.
69+
- **CVE-2025-69418 (Low, low-level OCB):** Node.js uses the EVP API, which the advisory confirms avoids the vulnerable path.
70+
- **CVE-2025-69419 (Low, PKCS12_get_friendlyname):** Node.js does not call this function; the advisory notes `PKCS12_parse()` uses a separate safe path.
71+
- **CVE-2025-69420 (Low, TS_RESP_verify_response):** Node.js does not use timestamp protocol APIs.
72+
- **CVE-2026-22796 (Low, PKCS7_digest_from_attributes):** Node.js does not call PKCS#7 signature verification APIs.
73+
74+
## Contact and future updates
75+
76+
The current Node.js security policy can be found at <https://github.com/nodejs/node/security/policy#security>,
77+
including information on how to report a vulnerability in Node.js.
78+
79+
Subscribe to the low-volume announcement-only **nodejs-sec** mailing list at
80+
https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on
81+
security vulnerabilities and security-related releases of Node.js and the
82+
projects maintained in the
83+
[nodejs GitHub organization](https://github.com/nodejs).

0 commit comments

Comments
 (0)