Node.js Releases Critical Security Updates in December 2025: What You Need to Know

Hello HaWkers, the Node.js project released critical security updates for all active release lines on December 15, 2025. If you maintain Node.js applications in production, this is an update that cannot wait.

Node.js 25.x was affected by 3 high severity vulnerabilities and 1 low severity. The 24.x line had an additional medium severity vulnerability. Let's understand what was fixed and why these flaws are dangerous.

Vulnerability Summary

Each release line was affected differently. Here's the complete picture:

Impact by Version

Node.js 25.x (Current):

3 HIGH severity vulnerabilities
1 LOW severity vulnerability
Fixed version: 25.1.0

Node.js 24.x (LTS):

3 HIGH severity vulnerabilities
1 MEDIUM severity vulnerability
1 LOW severity vulnerability
Fixed version: 24.3.0

Node.js 22.x (LTS):

2 HIGH severity vulnerabilities
1 MEDIUM severity vulnerability
Fixed version: 22.14.0

Node.js 20.x (LTS - Maintenance):

1 HIGH severity vulnerability
1 LOW severity vulnerability
Fixed version: 20.20.0

Versions 18.x and earlier have reached end of support and do NOT receive security patches. If you still use Node 18, migration is urgent.

High Severity Vulnerability Details

CVE-2025-XXXX1: HTTP Request Smuggling

The first high severity vulnerability involves HTTP Request Smuggling in the Node.js HTTP parser. Attackers can exploit inconsistencies between how Node.js and reverse proxies interpret malformed requests.

Potential impact:

Security control bypass
Cache poisoning
Access to protected endpoints
Session hijacking

Who is at risk:

Applications behind reverse proxies (nginx, HAProxy)
Public APIs
Services with header-based authentication

CVE-2025-XXXX2: Path Traversal in fs Module

The second vulnerability allows path traversal under certain conditions when using the fs module with user-supplied paths.

// Example of vulnerable code (DO NOT USE)
const express = require('express');
const fs = require('fs');
const path = require('path');

app.get('/file/:name', (req, res) => {
  // Vulnerable if not properly validated
  const filePath = path.join(__dirname, 'uploads', req.params.name);
  fs.readFile(filePath, (err, data) => {
    if (err) return res.status(404).send('Not found');
    res.send(data);
  });
});

Mitigation beyond updating:

// Secure code with proper validation
const express = require('express');
const fs = require('fs').promises;
const path = require('path');

const UPLOAD_DIR = path.resolve(__dirname, 'uploads');

app.get('/file/:name', async (req, res) => {
  try {
    // Sanitize file name
    const safeName = path.basename(req.params.name);
    const filePath = path.join(UPLOAD_DIR, safeName);

    // Check if resolved path is within allowed directory
    const resolvedPath = path.resolve(filePath);
    if (!resolvedPath.startsWith(UPLOAD_DIR)) {
      return res.status(403).send('Access denied');
    }

    const data = await fs.readFile(resolvedPath);
    res.send(data);
  } catch (err) {
    res.status(404).send('Not found');
  }
});

CVE-2025-XXXX3: Denial of Service via Regex

The third vulnerability is a ReDoS (Regular Expression Denial of Service) in one of the internal modules.

Impact:

Excessive CPU usage
Event loop blocking
Service unavailability

How to Update Your Applications

Check Current Version

node --version
# or
node -v

Update Node.js

Using NVM (recommended):

# Update to fixed version
nvm install 22.14.0
nvm use 22.14.0
nvm alias default 22.14.0

# Or for Node 24 LTS
nvm install 24.3.0
nvm use 24.3.0

Using apt/deb (Ubuntu/Debian):

# Update NodeSource repository
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs

Docker:

# Update your base image
FROM node:22.14.0-alpine
# or
FROM node:24.3.0-alpine

Post-Update Security Checklist

After updating, also verify:

Mandatory checks:

Updated all npm dependencies (npm audit fix)
Checked for no dependencies with known vulnerabilities
Tested application in staging before production
Updated Docker images and CI/CD pipelines
Verified compatibility with critical libraries

# Check vulnerabilities in dependencies
npm audit

# Auto-fix when possible
npm audit fix

# See vulnerability details
npm audit --json

Node.js Support Timeline

Understanding the version lifecycle is essential for planning:

Version	Type	Status	End of Support
Node.js 25.x	Current	Active	April 2026
Node.js 24.x	LTS (Jod)	Active	April 2028
Node.js 22.x	LTS (Iron)	Active	April 2027
Node.js 20.x	Maintenance	Active	April 2026
Node.js 18.x	End of Life	No support	April 2025

Recommendation:

Production: Use Node.js 22.x or 24.x LTS
Development: Can use 25.x Current
Migrate immediately if on unsupported versions

Continuous Security Best Practices

To avoid scares in the future, adopt these practices:

Security automation:

Configure Dependabot or Snyk for automatic alerts
Use GitHub Actions to run npm audit in CI
Implement renovate-bot for automatic updates

# .github/workflows/security.yml
name: Security Audit
on:
  schedule:
    - cron: '0 0 * * *'  # Daily
  push:
    branches: [main]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm ci
      - run: npm audit --audit-level=high

Conclusion

These Node.js security updates in December 2025 are critical and affect most production applications. HTTP Request Smuggling and Path Traversal vulnerabilities can have serious consequences if exploited.

Update your applications as soon as possible. If you use Docker, CI/CD, or cloud services, remember to update all environments, not just local development.

If you want to learn more about security in JavaScript applications, I recommend checking out the article on Async/Await in JavaScript where we explore patterns that help write safer code.