# Node.js 17 security updates

The latest version of Node.js 17 is 17.9.1, released June 1, 2022. Patch Radar has 1 security fix for Node.js 17, closing 4 CVEs. The newest is Node.js 17 17.3.1 (17.3.1), released January 10, 2022. 11 CVEs have no fix yet.

- Web page: https://patchblox.com/security/product/windows-app/node.js-17
- Platform: Windows apps
- Vendor: Node.js Foundation
- Latest version: 17.9.1 (Jun 1, 2022)
- Supported: yes

## CVEs with no fix yet

| CVE | Priority | Title | Status |
|---|---|---|---|
| [CVE-2024-3566](https://patchblox.com/security/data/cve/CVE-2024-3566.md) | Urgent | Command injection vulnerability in programing languages on Microsoft Windows operating system. | no-fix |
| [CVE-2026-106071](https://patchblox.com/security/data/cve/CVE-2026-106071.md) | High | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.  When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.  This vulnerability affects Node.js **26.x**. | no-fix |
| [CVE-2026-21637](https://patchblox.com/security/data/cve/CVE-2026-21637.md) | High | HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers | no-fix |
| [CVE-2026-21710](https://patchblox.com/security/data/cve/CVE-2026-21710.md) | High | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.  When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.  * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | no-fix |
| [CVE-2026-21711](https://patchblox.com/security/data/cve/CVE-2026-21711.md) | High | Node.js 14 and 12 others: Improper Access Control | no-fix |
| [CVE-2026-21713](https://patchblox.com/security/data/cve/CVE-2026-21713.md) | High | Node.js 14 and 15 others: Observable Timing Discrepancy | no-fix |
| [CVE-2026-21714](https://patchblox.com/security/data/cve/CVE-2026-21714.md) | High | Node.js 14 and 15 others: Missing Release of Memory after Effective Lifetime | no-fix |
| [CVE-2026-21715](https://patchblox.com/security/data/cve/CVE-2026-21715.md) | High | Node.js 14 and 15 others: Incorrect Permission Assignment for Critical Resource | no-fix |
| [CVE-2026-21716](https://patchblox.com/security/data/cve/CVE-2026-21716.md) | High | Node.js 14 and 15 others: Missing Authorization | no-fix |
| [CVE-2026-21717](https://patchblox.com/security/data/cve/CVE-2026-21717.md) | High | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.  The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.  This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | no-fix |
| [CVE-2026-106070](https://patchblox.com/security/data/cve/CVE-2026-106070.md) | Routine | Node.js and 17 others: Business Logic Errors | no-fix |

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| [Node.js 17 17.3.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.17-17.3.1.md) | Jan 10, 2022 | 17.3.1 | High | 4 | 0 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo