Skip to content

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Michael Dawson <[email protected]>
Signed-off-by: Rafael Gonzaga <[email protected]>
  • Loading branch information
RafaelGSS and mhdawson authored Mar 6, 2025
1 parent a0d95e4 commit 60bc31c
Showing 1 changed file with 10 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,16 @@ layout: blog-post
author: Rafael Gonzaga
---

# Rationale for Issuing CVEs on End-of-Life Node.js Versions

**TL;DR:** CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 have been
rejected by MITRE and therefore the Node.js team decided to update previous
CVEs to cover EOL releases, reflecting their ongoing security risks.
# Update on the issuance of CVEs to mark End-of-Life Node.js Versions

**TL;DR:** CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to
tag EOL versions have been rejected by MITRE.
The Node.js team has, therefore, decided to update previous vulnerability specific
CVEs to cover EOL releases, reflecting their ongoing security risks. This means that
all new CVEs issued will include EOL releases in the applicability until we have specific
information that indicates a CVE does not apply to an EOL release line. The project
does not plan to evaluate CVEs against EOL lines but information provided to the
project may be used to update the applicability if/when it is available.

On January 21, 2025, Node.js released security patches for four active release
lines. At the same time, CVEs were assigned to cover EOL (end-of-life) versions:
Expand Down

0 comments on commit 60bc31c

Please sign in to comment.