# OpenSSL security releases do not require Node.js security releases

DevFeed: [OpenSSL security releases do not require Node.js security releases](<https://devfeed.tech/articles/openssl-security-releases-do-not-require-node-js-security-releases-2909.md>)

Original publisher: [Read original article](<https://nodejs.org/en/blog/vulnerability/september-2019-openssl-no-updates>)

Published: 2019-09-12T17:00:15Z

Content type: article

Language: en

Sources: [Node.js Blog](<https://devfeed.tech/sources/node-js-blog.md>)

Topics: [Node.js](<https://devfeed.tech/topics/node-js.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [node-js](<https://devfeed.tech/tags/node-js.md>), [openssl](<https://devfeed.tech/tags/openssl.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>)

## AI overview

Node.js states that the OpenSSL security releases of September 10, 2019 do not affect Node.js. The cited ECDSA timing attack, fork protection issue, and padding oracle issue are assessed as not affecting Node.js because of its supported behavior and limitations. The OpenSSL updates will therefore be included as regular, non-security patch updates.

## Source excerpt

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.