# Node.js 2.5.0: end of life

This release line no longer gets security fixes.

- Recommended: 22.23.4 (lowest fixed release that is still supported)
- Known vulnerabilities: 3 (1 critical, 0 high, 0 medium, 0 low)
- End of life: yes (release line 2)
- Data as of: 2026-10-25 01:07 UTC

## Vulnerabilities

| ID | Severity | Actively exploited | Fixed in |
|---|---|---|---|
| [CVE-2024-3566](https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/) | critical | no | — |
| [CVE-2019-5739](https://security.gentoo.org/glsa/202003-48) | unknown | no | 6.17.0 |
| [CVE-2019-5737](https://access.redhat.com/errata/RHSA-2019:1821) | unknown | no | 6.17.0 |

Installed with apt, yum or another package manager? Your distribution may already have patched this without changing the version, so check its security tracker too.

---

FixedIn gives information, not guarantees. Always confirm with the vendor's advisory before you rely on a result. Source: https://fixedin.dev/nodejs/2.5.0 · JSON: https://fixedin.dev/nodejs/2.5.0.json · MCP server: https://fixedin.dev/mcp · About these addresses: https://fixedin.dev/llms.txt