Nodejs fixed 8 vulnerabilities:
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
There's a bunch of confusing things:
- the announcement is published today at a URL from last month with a link saying "January Security Release is available" linking to itself
- the 'release details' links in the advisory 404 (you want to go to the GitHub releases page instead)
- announcement to nodejs-sec mailing list is only a terse note saying "Security release is now available" with not even a link