{
  "product": "Node.js 21",
  "url": "https://patchblox.com/security/product/windows-app/node.js-21",
  "summary": "The latest version of Node.js 21 is 21.7.3, released April 10, 2024. Patch Radar has 3 security fixes for Node.js 21, closing 11 CVEs. The newest is Node.js 21 21.7.3 (21.7.3), released April 10, 2024. 2 CVEs have no fix yet.",
  "platform": "windows-app",
  "vendor": "Node.js Foundation",
  "supported": true,
  "latestVersion": "21.7.3",
  "latestReleased": "2024-04-10T00:00:00Z",
  "fixCount": 3,
  "cveCount": 11,
  "exploitedCveCount": 0,
  "unfixedCveCount": 2,
  "fixes": [
    {
      "fix": "Node.js 21 21.7.3",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.21-21.7.3",
      "released": "2024-04-10T00:00:00Z",
      "fixedVersion": "21.7.3",
      "priority": "Urgent",
      "cveCount": 2,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 21 21.7.2",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.21-21.7.2",
      "released": "2024-04-03T00:00:00Z",
      "fixedVersion": "21.7.2",
      "priority": "High",
      "cveCount": 2,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 21 21.6.2",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.21-21.6.2",
      "released": "2024-02-13T00:00:00Z",
      "fixedVersion": "21.6.2",
      "priority": "High",
      "cveCount": 7,
      "exploitedCveCount": 0
    }
  ],
  "noFixYet": [
    {
      "cveId": "CVE-2026-106071",
      "url": "https://patchblox.com/security/cve/CVE-2026-106071",
      "title": "A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard \u0060--allow-fs-read\u0060 or \u0060--allow-fs-write\u0060 rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, \u0060--allow-fs-read=/etc/passwd.*\u0060 also allows reading \u0060/etc/passwd\u0060. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "21.7.3"
    },
    {
      "cveId": "CVE-2026-106070",
      "url": "https://patchblox.com/security/cve/CVE-2026-106070",
      "title": "Node.js and 17 others: Business Logic Errors",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "21.7.3"
    }
  ],
  "dataAsOf": "2026-11-07T06:34:28Z"
}