Packablock Supply Chain Intelligence Report SBOM Insights

REF: OPENSSL-IN-NODEJS-22 · UPDATED: 2026-09-24

What version of OpenSSL is in Node.js 22 LTS?

Node.js v22.6.0 • Package type: GENERIC • pkg:generic/nodejs/node@v22.6.0

Summary

Node.js v22.6.0 embeds OpenSSL 3.0.13+quic as its primary cryptographic runtime engine, providing default TLS 1.3 ciphers, modernized provider architecture, and QUIC packet parsing primitives. Legacy cryptographic algorithms are disabled by default and require explicit legacy provider invocation.

🔗 Dependency Relationship

Package	Version	Relationship	Ingestion Scope	Package URL (PURL)
openssl Target	3.0.13+quic	Direct Dependency	↳ Statically linked core engine	pkg:generic/openssl@3.0.13+quic
openssl-legacy-provider	3.0.13	Direct Dependency	↳ Direct core provider module	pkg:generic/openssl-legacy-provider@3.0.13
libcrypto.so.3	3.0.x	Transitive Dependency	↳ Dynamic host ABI boundary	pkg:generic/libcrypto.so.3@3.0.x

Analysis

Node.js 22 LTS statically embeds OpenSSL 3.0.13 with specialized QUIC API extensions directly into its core binary (`deps/openssl/openssl`). Unlike prior Node.js LTS releases that utilized OpenSSL 1.1 or monolithic provider setups, Node.js 22 operates under OpenSSL 3.0's modular Provider Architecture. Legacy cryptographic algorithms (MD4, RC4, DES, Blowfish) are isolated into a separate legacy provider (`legacy.so`), causing unhandled `ERR_OSSL_EVP_UNSUPPORTED` runtime exceptions unless `--openssl-legacy-provider` is explicitly enabled. Furthermore, when native C++ npm addons (`node-gyp`) dynamically link against host operating system libraries (`libcrypto.so.3` or legacy OpenSSL 1.1), dual-engine symbol collisions and ABI divergence can trigger fatal segmentation faults during EVP cipher context handoffs. (source: OpenSSL Foundation) ↗ (source: Node.js Project) ↗

SBOM Insights

⚡ Synthesized SBOM

Deterministic baseline metadata collected on-demand from the upstream Google deps.dev v3 package graph without repository checkout.

Total Upstream Deps deps.dev ↗

60

18 direct · 42 transitive

Release Date GitHub ↗

2024-08-06

Node.js C++ Runtime (pkg:generic/nodejs)

Software Licenses

6 Distinct

Primary: MIT

Graph OpenSSF Avg

6.3 / 10

Supply Chain Posture

Vulnerabilities Evaluated

3 Target · 3 Host

0 Active CISA KEV

Package Type FAQ ↗

Node.js C++ Runtime (pkg:generic/nodejs)

● pkg:generic

Supply Chain Governance

Node.js 22.6 is regulated by the following European Union and United States supply chain directives and security frameworks:

Regulatory Body	Directive / Framework	Official Identifier	Statutory Scope & Classification	Official Directive
European Union / European Commission	EU Cyber Resilience Act (CRA)	Regulation (EU) 2024/2847	Important Product with Digital Elements (Class I / General Purpose Operating & Runtime Environment)	Directive Text ↗
ENISA / European Commission	NIS2 Directive	Directive (EU) 2022/2555	Digital Infrastructure & Cloud Services (Annex I - Essential Entity)	Directive Text ↗
NIST / CMVP	FIPS 140-2 / 140-3 Cryptographic Standards	FIPS PUB 140-3	Security Requirements for Cryptographic Modules	Directive Text ↗

Authoritative Verified Facts & Advisories

Authoritative weakness definitions, CVE records, and predictive EPSS weaponization telemetry partitioned by target dependency and host container environment.

Target Package Advisories & Weaknesses: openssl

6 Verified Records

MITRE CWE CWE-327 Likelihood: High / Cryptographic Deprecation

Official Reference ↗

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Deprecation and runtime rejection (ERR_OSSL_EVP_UNSUPPORTED) of legacy weak ciphers (MD4, RC4, DES) in OpenSSL 3.0 default provider.

MITRE CWE CWE-1104 Likelihood: Medium

Official Reference ↗

CWE-1104: Use of Unmaintained or Incompatible Third Party Components

Native C++ node-gyp addon ABI mismatch and EVP cipher context corruption when linking against divergent host libcrypto versions.

MITRE CWE CWE-681 Likelihood: Medium / Precision Loss

Official Reference ↗

CWE-681: Incorrect Conversion between Numeric Types

Truncation of 64-bit cryptographic nonces and Snowflake IDs exceeding JavaScript IEEE-754 MAX_SAFE_INTEGER.

CVE.ORG CVE-2024-2511 EPSS: 52.42% (98.9th pctl)

Official Reference ↗

CVE-2024-2511: OpenSSL TLS Session Ticket Memory Growth (DoS)

Unbounded memory growth flaw in OpenSSL session ticket caching triggered during concurrent TLS handshake renegotiation.

CVE.ORG CVE-2024-4603 EPSS: 1.13% (65.0th pctl)

Official Reference ↗

CVE-2024-4603: OpenSSL Excessive DSA Key Parameter Validation (DoS)

Denial of service via excessive computational resource consumption during validation of overly long DSA keys in OpenSSL.

CVE.ORG CVE-2024-4741 EPSS: 2.93% (86.5th pctl)

Official Reference ↗

CVE-2024-4741: OpenSSL Use-After-Free in SSL_free_buffers

Use-after-free vulnerability in OpenSSL when freeing buffers after handling incoming TLS network traffic.

Host Application Advisories: Node.js v22.6.0

Deduplicated from 6 advisory records indexed by Google deps.dev and OSV · 0 Active CISA KEV

3 Distinct CVEs Monitored

CVE.ORG CVE-2024-39338 EPSS: 0.09% (38.4th pctl) Not Weaponized

Official Reference ↗

CVE-2024-39338: Node.js Permission Model Path Traversal via document.location

Experimental permission model bypass allowing path traversal via document.location handling.

CVE.ORG CVE-2024-36138 EPSS: 0.09% (41.2th pctl) Not Weaponized

Official Reference ↗

CVE-2024-36138: Node.js Permission Model Bypass via process.mainModule

Permission model bypass permitting arbitrary filesystem read/write via prototype mutation of process.mainModule.

CVE.ORG CVE-2024-22025 EPSS: 0.42% (73.5th pctl) Not Weaponized

Official Reference ↗

CVE-2024-22025: Node.js Denial of Service via HTTP/2 CONTINUATION Frames

HTTP/2 CONTINUATION flood vulnerability allowing remote attackers to exhaust memory and crash Node.js servers.

Baseline dependency metadata indexed from Google deps.dev v3 API and FIRST.org EPSS telemetry.