{
  "product": "Node.js 22",
  "url": "https://patchblox.com/security/product/windows-app/node.js-22",
  "summary": "The latest version of Node.js 22 is 22.23.4, released October 20, 2026. Patch Radar has 9 security fixes for Node.js 22, closing 52 CVEs. The newest is Node.js 22 22.23.4 (22.23.4), released October 20, 2026. 2 CVEs have no fix yet.",
  "platform": "windows-app",
  "vendor": "Node.js Foundation",
  "supported": true,
  "latestVersion": "22.23.4",
  "latestReleased": "2026-10-20T00:00:00Z",
  "fixCount": 9,
  "cveCount": 52,
  "exploitedCveCount": 0,
  "unfixedCveCount": 2,
  "fixes": [
    {
      "fix": "Node.js 22 22.23.4",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.23.4",
      "released": "2026-10-20T00:00:00Z",
      "fixedVersion": "22.23.4",
      "priority": "High",
      "cveCount": 6,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 22 22.23.2",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.23.2",
      "released": "2026-07-28T00:00:00Z",
      "fixedVersion": "22.23.2",
      "priority": "High",
      "cveCount": 11,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 22 22.23.0",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.23.0",
      "released": "2026-06-17T00:00:00Z",
      "fixedVersion": "22.23.0",
      "priority": "Urgent",
      "cveCount": 12,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 22 22.22.2",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.22.2",
      "released": "2026-03-24T00:00:00Z",
      "fixedVersion": "22.22.2",
      "priority": "High",
      "cveCount": 6,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 22 22.22.0",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.22.0",
      "released": "2026-01-12T00:00:00Z",
      "fixedVersion": "22.22.0",
      "priority": "High",
      "cveCount": 6,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 22 22.17.1",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.17.1",
      "released": "2025-07-15T00:00:00Z",
      "fixedVersion": "22.17.1",
      "priority": "High",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 22 22.15.1",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.15.1",
      "released": "2025-05-14T00:00:00Z",
      "fixedVersion": "22.15.1",
      "priority": "High",
      "cveCount": 2,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 22 22.13.1",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.13.1",
      "released": "2025-01-21T00:00:00Z",
      "fixedVersion": "22.13.1",
      "priority": "High",
      "cveCount": 3,
      "exploitedCveCount": 0
    },
    {
      "fix": "Node.js 22 22.4.1",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.22-22.4.1",
      "released": "2024-07-08T00:00:00Z",
      "fixedVersion": "22.4.1",
      "priority": "High",
      "cveCount": 5,
      "exploitedCveCount": 0
    }
  ],
  "noFixYet": [
    {
      "cveId": "CVE-2026-106071",
      "url": "https://patchblox.com/security/cve/CVE-2026-106071",
      "title": "A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard \u0060--allow-fs-read\u0060 or \u0060--allow-fs-write\u0060 rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, \u0060--allow-fs-read=/etc/passwd.*\u0060 also allows reading \u0060/etc/passwd\u0060. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "22.23.4"
    },
    {
      "cveId": "CVE-2026-106070",
      "url": "https://patchblox.com/security/cve/CVE-2026-106070",
      "title": "Node.js and 17 others: Business Logic Errors",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "22.23.4"
    }
  ],
  "dataAsOf": "2026-11-07T06:34:28Z"
}