René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Node.js 20.19.4 includes OpenSSL 3.0.15 which has known CVEs fixed in 3.0.16","articleBody":"### Version\n\nv20.19.4\n\n### Platform\n\n```text\nLinux CPC-jiec-GCIK3D 6.6.87.2-microsoft-standard-WSL2 #1 SMP PREEMPT_DYNAMIC Thu Jun  5 18:30:46 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux\n```\n\n### Subsystem\n\nopenssl\n\n### What steps will reproduce the bug?\n\nI noticed that Node.js 20.19.4 LTS currently includes OpenSSL `3.0.15+quic` (By running `node -e \"console.log('OpenSSL version:', process.versions.openssl)\"`). OpenSSL 3.0.16 was recently released with fixes for a couple of security vulnerabilities. I wanted to bring this to your attention in case it would be helpful to consider updating to the newer version.\n\n### How often does it reproduce? Is there a required condition?\n\nOpenSSL 3.0.16 includes fixes for:\n\n1. **CVE-2024-13176** - [GHSA-r9fv-h47r-823f](https://github.com/advisories/GHSA-r9fv-h47r-823f)\n2. **CVE-2024-9143** - [GHSA-q764-r57m-9wp9](https://github.com/advisories/GHSA-q764-r57m-9wp9)\n\n### What is the expected behavior? Why is that the expected behavior?\n\nWould it be possible to consider updating OpenSSL to version 3.0.16 in a future Node.js 20.x LTS patch release? I understand this would need to go through the normal testing and release process.\n\n### What do you see instead?\n\nCurrently, Node.js 20.x LTS latest version uses OpenSSL `3.0.15+quic`\n\n### Additional information\n\nThank you!","author":{"url":"https://github.com/jiec-msft","@type":"Person","name":"jiec-msft"},"datePublished":"2025-08-20T11:02:31.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/59548/node/issues/59548"}