Repository navigation
Node 24.13.0 built with openssl 3.5.4 #61755
Description
Version
24.13.0
Platform
Darwin 24.6.0 Darwin Kernel Version 24.6.0: Mon Jul 14 11:30:29 PDT 2025; root:xnu-11417.140.69~1/RELEASE_ARM64_T6000 arm64
Subsystem
No response
What steps will reproduce the bug?
CVE-2025-15467 is patched in openssl 3.5.5, but node 24.13.0 is built using 3.5.4, AWS inspector finds 3.5.4 in 3 files:
/usr/local/include/node/openssl/archs/linux-x86_64/asm/include/openssl/opensslv.h
/usr/local/include/node/openssl/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h
/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h
How often does it reproduce? Is there a required condition?
You can cat out the files and see the version there
What is the expected behavior? Why is that the expected behavior?
openssl 3.5.5 in the node build
What do you see instead?
3.5.4
Additional information
No response
Activity
Renegade334 commentedon Feb 9, 2026
Already addressed by #61547, will be included in the v24.13.1 patch release.
acdha commentedon Feb 9, 2026
@Renegade334 will this also be back ported to v22?
Renegade334 commentedon Feb 9, 2026
It is earmarked for backporting, yes.
acdha commentedon Feb 9, 2026
Thank you, I had a couple of teams ask.