Skip to content

Commit 3b62b63

Browse files
authored
doc: clarify updates to CVE to EOL (#7551)
As requested by the board program
1 parent 74f2e38 commit 3b62b63

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

Diff for: apps/site/pages/en/blog/vulnerability/updates-cve-for-end-of-life.md

+7-5
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ author: Rafael Gonzaga
99
# Update on the issuance of CVEs to mark End-of-Life Node.js Versions
1010

1111
**TL;DR:** CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 issued to
12-
tag EOL versions have been rejected by MITRE.
12+
tag EOL versions have been rejected by the CVE Program.
1313
The Node.js team has, therefore, decided to update previous vulnerability specific
1414
CVEs to cover EOL releases, reflecting their ongoing security risks. This means that
1515
all new CVEs issued will include EOL releases in the applicability until we have specific
@@ -62,12 +62,14 @@ risks to organizations.
6262
Following consultations with the CVE Program, HackerOne, and Node.js, further
6363
updates were made to these CVEs:
6464

65-
- MITRE has tagged the CVEs with "unsupported when assigned" and marked them as "disputed" since they do not pinpoint a specific vulnerability.
65+
- The MITRE Top-Level Root tagged the CVEs with "unsupported when assigned" and marked them as "disputed" since they do not pinpoint a specific vulnerability.
6666
- A note has been added indicating that using the CVE List to report an unsupported product is a new approach under review.
6767

68-
Ultimately, the Board decided to **reject** these CVEs. However, this decision
69-
does not determine the long-term stance of the CVE Program on EOL support.
70-
The Board will continue discussing potential solutions for managing EOL versions.
68+
Ultimately, the CVE Board decided that these CVE Records should be rejected
69+
given the current CNA Operational Rules. However, this decision does not
70+
determine the long-term stance of the CVE Program on EOL support.
71+
The Board will continue discussing potential solutions for managing EOL
72+
versions, and is collecting feedback from the community.
7173

7274
Therefore, the only _viable_ solution to reflect the risk of running and EOL
7375
line is to update previous CVEs to cover EOL releases, reflecting

0 commit comments

Comments
 (0)