{
  "product": "Node.js 23",
  "url": "https://patchblox.com/security/product/windows-app/node.js-23",
  "summary": "The latest version of Node.js 23 is 23.11.0, released April 1, 2025. Patch Radar has 1 security fix for Node.js 23, closing 3 CVEs. The newest is Node.js 23 23.6.1 (23.6.1), released January 21, 2025. 3 CVEs have no fix yet.",
  "platform": "windows-app",
  "vendor": "Node.js Foundation",
  "supported": true,
  "latestVersion": "23.11.0",
  "latestReleased": "2025-04-01T00:00:00Z",
  "fixCount": 1,
  "cveCount": 3,
  "exploitedCveCount": 0,
  "unfixedCveCount": 3,
  "fixes": [
    {
      "fix": "Node.js 23 23.6.1",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.23-23.6.1",
      "released": "2025-01-21T00:00:00Z",
      "fixedVersion": "23.6.1",
      "priority": "High",
      "cveCount": 3,
      "exploitedCveCount": 0
    }
  ],
  "noFixYet": [
    {
      "cveId": "CVE-2025-23166",
      "url": "https://patchblox.com/security/cve/CVE-2025-23166",
      "title": "Node.js 20 and 3 others: Uncaught Exception",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "23.11.0"
    },
    {
      "cveId": "CVE-2026-106071",
      "url": "https://patchblox.com/security/cve/CVE-2026-106071",
      "title": "A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard \u0060--allow-fs-read\u0060 or \u0060--allow-fs-write\u0060 rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, \u0060--allow-fs-read=/etc/passwd.*\u0060 also allows reading \u0060/etc/passwd\u0060. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**.",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "23.11.0"
    },
    {
      "cveId": "CVE-2026-106070",
      "url": "https://patchblox.com/security/cve/CVE-2026-106070",
      "title": "Node.js and 17 others: Business Logic Errors",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "23.11.0"
    }
  ],
  "dataAsOf": "2026-11-07T06:34:28Z"
}