[tajen]

The most surprising to me is that NodeJS says they are affected https://nodejs.org/en/blog/vulnerability/openssl-november-20...

[tempay]

The offical NodeJS binaries statically link to OpenSSL so they have the be patched explicitly for OpenSSL vulnerabilities.

[bilalq]

They're only affected in the sense that newer versions of Node use OpenSSL 3.x.

> Node.js v18.x and v19.x use OpenSSL v3. Therefore these release lines are impacted by this update.

> Node.js 14.x and v16.x are not affected by this OpenSSL update.

> At this stage, due to embargo, the exact nature of these defects is uncertain as well as the impact they will have on Node.js users.

> After assessing the impact on Node.js, it will be decided whether the issues fixed require immediate security releases of Node.js, or whether they can be included in the normally scheduled updates.

[joecool1029]

Might be more surprising to you that it looks like you're shadowbanned with all your comments showing up dead (last 2 were vouched). I glanced at your post history and couldn't see why so you might want to send an email to [e-mail].

[fulafel]

I wonder if they are built with stack protector turned on in the compiler flags.