Repository navigation
Openssl vulnerabilities in node22 releases #63166
Description
We are using node 22.22.1 (https://nodejs.org/en/download/archive/v22.22.1) and it has several CVEs related to openssl:
https://nvd.nist.gov/vuln/detail/CVE-2026-31789
https://nvd.nist.gov/vuln/detail/CVE-2026-31789
https://nvd.nist.gov/vuln/detail/CVE-2026-28389
https://nvd.nist.gov/vuln/detail/CVE-2026-28390
https://nvd.nist.gov/vuln/detail/CVE-2026-31790
https://nvd.nist.gov/vuln/detail/CVE-2026-28388
https://nvd.nist.gov/vuln/detail/CVE-2026-28387
https://nvd.nist.gov/vuln/detail/CVE-2026-2673
https://nvd.nist.gov/vuln/detail/CVE-2026-28387
https://nvd.nist.gov/vuln/detail/CVE-2026-28390
https://nvd.nist.gov/vuln/detail/CVE-2026-28388
https://nvd.nist.gov/vuln/detail/CVE-2026-28389
https://nvd.nist.gov/vuln/detail/CVE-2026-31790
https://nvd.nist.gov/vuln/detail/CVE-2026-2673
We tracked and upgraded to several minor releases for node 22, but no release adopted latest openssl that can fix above CVEs. Is there any specific reason why node is not upgrading the openssl version?
AWS inspector is flagging all our images as vulnerable and asking to switch from 3.5.5 to 3.6.2.
Activity
Renegade334 commentedon May 7, 2026
Where OpenSSL releases identify genuine attack vectors in Node.js, they will trigger a security release. If not, then the dependency is updated with the next planned release, which in this case will be mid-May.
MikeMcC399 commentedon May 14, 2026
Node.js 22.22.3 updated to OpenSSL 3.5.6 - see #62629
As a spot check, https://nvd.nist.gov/vuln/detail/CVE-2026-31789, for example, is mitigated by 3.5.6