Need some help with CVEs related to V8 JS engine

[sshedi]

Hi, is nodejs-22.X is affected by following V8 CVEs?

CVE-2025-10585
CVE-2025-12432
CVE-2025-13226
CVE-2025-13227
CVE-2025-13223

[rohitbytecode]

Node.js itself does not arbitrarily inherit all CVEs listed against V8. it depends on whether the vulnerable V8 version is actually included in the specific Node.js release in question.
For Node.js 22.x, the relevant security exposure must be evaluated against:
The exact V8 version shipped in that Node release
Whether the specific CVE applies to functionality actually compiled into Node

How to Check If Node 22.x Includes a Vulnerable V8

1. Identify the V8 version

You can find which V8 version is bundled in your Node 22.x build by checking:
node -p "process.versions.v8"
2. Map the CVEs to V8 Releases
Each CVE should describe which V8 version ranges it affects. For example:

CVE-2025-10585: affects V8 ≤ 11.10.13
CVE-2025-12432: affects V8 ≤ 11.11.0
etc.
This mapping is usually documented in the CVE details themselves or in V8’s own security tracking.

Things you can consider:
Run process.versions.v8 on the specific Node 22.x build.
Check each CVE’s version range to see if it applies to that V8 version.
Check Node’s security release notes. Node frequently backports fixes.
If any CVE does apply to your version, the safest option is to update Node to the latest security release in the 22.x line.

[sshedi]

Thank you for the response, this helps.