The Node.js project just issued CVE IDs for 3 EOL versions

Is this a good idea or a bad idea? It depends who you ask

It's a weird discussion to follow, so I broke it down in a way that should offend all the involved parties

opensourcesecurity.io/2025/01-…

CVEs for End of Life?

Very recently the Node.js project filed a few CVE IDs for end of life products. For vulnerability nerds this is exciting because historically EOL things didn’t get CVE IDs just for being EOL.

^{Josh Bressers (Open Source Security)}