You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: apps/site/pages/en/blog/vulnerability/updates-cve-for-end-of-life.md
+7-5
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ author: Rafael Gonzaga
9
9
# Update on the issuance of CVEs to mark End-of-Life Node.js Versions
10
10
11
11
**TL;DR:**CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to
12
-
tag EOL versions have been rejected by MITRE.
12
+
tag EOL versions have been rejected by the CVE Program.
13
13
The Node.js team has, therefore, decided to update previous vulnerability specific
14
14
CVEs to cover EOL releases, reflecting their ongoing security risks. This means that
15
15
all new CVEs issued will include EOL releases in the applicability until we have specific
@@ -62,12 +62,14 @@ risks to organizations.
62
62
Following consultations with the CVE Program, HackerOne, and Node.js, further
63
63
updates were made to these CVEs:
64
64
65
-
- MITRE has tagged the CVEs with "unsupported when assigned" and marked them as "disputed" since they do not pinpoint a specific vulnerability.
65
+
-The MITRE Top-Level Root tagged the CVEs with "unsupported when assigned" and marked them as "disputed" since they do not pinpoint a specific vulnerability.
66
66
- A note has been added indicating that using the CVE List to report an unsupported product is a new approach under review.
67
67
68
-
Ultimately, the Board decided to **reject** these CVEs. However, this decision
69
-
does not determine the long-term stance of the CVE Program on EOL support.
70
-
The Board will continue discussing potential solutions for managing EOL versions.
68
+
Ultimately, the CVE Board decided that these CVE Records should be rejected
69
+
given the current CNA Operational Rules. However, this decision does not
70
+
determine the long-term stance of the CVE Program on EOL support.
71
+
The Board will continue discussing potential solutions for managing EOL
72
+
versions, and is collecting feedback from the community.
71
73
72
74
Therefore, the only _viable_ solution to reflect the risk of running and EOL
73
75
line is to update previous CVEs to cover EOL releases, reflecting
0 commit comments