OpenSSL Security Advisory Assessment, January 2026

The OpenSSL project released a security advisory that includes 12 CVEs. After assessment, we have concluded that three CVEs affect Node.js (severity Low to Moderate). Given the limited attack surface, the OpenSSL updates will be included in upcoming regular Node.js releases rather than dedicated security releases.

All three vulnerabilities relate to how Node.js processes PFX (PKCS#12) certificate files, which are used when configuring TLS connections via the pfx option. An attacker would need to provide a specially crafted PFX file to trigger any of these issues. Since PFX files typically come from trusted local sources (e.g., your own private keys and certificates), the attack surface is limited in practice.