Skip to content

Add March 2025 CI incident blog post #7588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 1, 2025
Merged

Add March 2025 CI incident blog post #7588

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e854674
Add March 2025 CI incident blog post
mcollina Mar 31, 2025
a00b805
Update apps/site/pages/en/blog/vulnerability/march-2025-ci-incident.md
mcollina Mar 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions apps/site/pages/en/blog/vulnerability/march-2025-ci-incident.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
---
date: '2025-03-31T16:30:00.617Z'
category: vulnerability
title: Node.js Test CI Security Incident
layout: blog-post
author: Node.js Technical Steering Committee
---

On March 21st, the Node.js project received a security report regarding our development infrastructure via [our bug bounty program](https://hackerone.com/nodejs). We immediately restricted access while implementing corrective actions.

The reported issue did not impact the Node.js runtime and there is no risk to users of Node.js. No action by Node.js users is required.

The development infrastructure is expected to be available to the community by April 15 or sooner.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The development infrastructure is expected to be available to the community by April 15 or sooner.
The development infrastructure is expected to be available to the community by April 15th or sooner.


A full report of this incident will be available forthcoming. We appreciate the time investment from our amazing volunteers who assisted in this response.

## Contact and future updates

The current Node.js security policy can be found at [https://nodejs.org/security/](/security/). Please follow the process outlined in <https://github.com/nodejs/node/security/policy> if you wish to report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only nodejs-sec mailing list at <https://groups.google.com/forum/#!forum/nodejs-sec> to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization.
Loading