---
date: '2024-04-10T16:36:35.678Z'
category: release
title: Node.js 18.20.2 (LTS)
layout: blog-post
author: Rafael Gonzaga
---

## 2024-04-10, Version 18.20.2 'Hydrogen' (LTS), @RafaelGSS

This is a security release.

### Notable Changes

- CVE-2024-27980 - Command injection via args parameter of `child_process.spawn` without shell option enabled on Windows

### Commits

- \[[`6627222409`](https://github.com/nodejs/node/commit/6627222409)] - **src**: disallow direct .bat and .cmd file spawning (Ben Noordhuis) [nodejs-private/node-private#564](https://github.com/nodejs-private/node-private/pull/564)

Windows 32-bit Installer: https://nodejs.org/dist/v18.20.2/node-v18.20.2-x86.msi \
Windows 64-bit Installer: https://nodejs.org/dist/v18.20.2/node-v18.20.2-x64.msi \
Windows 32-bit Binary: https://nodejs.org/dist/v18.20.2/win-x86/node.exe \
Windows 64-bit Binary: https://nodejs.org/dist/v18.20.2/win-x64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v18.20.2/node-v18.20.2.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-aix-ppc64.tar.gz \
ARMv7 32-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-armv7l.tar.xz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v18.20.2/node-v18.20.2.tar.gz \
Other release files: https://nodejs.org/dist/v18.20.2/ \
Documentation: https://nodejs.org/docs/v18.20.2/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

f335733f4ae95fdb1c1011a59d79194768ad9d29c12fd07409163439944ee5dd  node-v18.20.2-aix-ppc64.tar.gz
2647d831f16b3dc7857ed4ee721d3c378194918ecda80b9471590250d328fa3c  node-v18.20.2-darwin-arm64.tar.gz
726e87689ac033ef73cb8041cc5e96c904a6e59971258008f17ee74c6ff4854b  node-v18.20.2-darwin-arm64.tar.xz
e26d8074da6d22ed23140e0ba964cba9c694f9b839ce48835d692a7a7e36421e  node-v18.20.2-darwin-x64.tar.gz
81d58aaadca73637ded8c6944980e4a66a1dc2b0eeaa7c380252912907fd8ccd  node-v18.20.2-darwin-x64.tar.xz
b31e5d82fb327373f7119fef3d1ee67b140a23c198e0f44f44b2e4ff9b3f29e5  node-v18.20.2-headers.tar.gz
6f3be52bfb4a8ecaea29ed8dbdb86694cdbae19334dc65cc2c982243b102978a  node-v18.20.2-headers.tar.xz
0b21ad5a11dd6c59a62eb34d1a0c2af28fe29187fa60da2c993b7cdf2a5a2f28  node-v18.20.2-linux-arm64.tar.gz
be36d2ad5842a7a9456b7de32fcc9656a6e0a79edab5f14ac05479d2eef2aa0e  node-v18.20.2-linux-arm64.tar.xz
adc55a8a594882b72967b05a4e47b4911879eeb44477f9447e05c84d420797ac  node-v18.20.2-linux-armv7l.tar.gz
19f0964f36a88546f73d4eb95e40b047d08205ed078061d2e4e9078e802231e8  node-v18.20.2-linux-armv7l.tar.xz
40193c181756789bb53130d5c96cfacb2e90dff3a5ef196014d4df8d9cecd6ba  node-v18.20.2-linux-ppc64le.tar.gz
7844f4d19174826b3c5162a92a0f6c7f028d324df4d59684e3e7ae40980358ed  node-v18.20.2-linux-ppc64le.tar.xz
3c56d6addf76802c5f4e28dfccf4919c1affdf7d47937b4df902250e72eeca89  node-v18.20.2-linux-s390x.tar.gz
08cb2f45228d9d812b107a15656316da99a79b0b4e69c7b33635ed96b5565647  node-v18.20.2-linux-s390x.tar.xz
a222595d353a7d1e48994a7d9c25e61ab1b8a1b0ce0652029f5cf999978b2e49  node-v18.20.2-linux-x64.tar.gz
d0584a21d83d710f947b210434449f6d2a65d14975d6fe9aaf430aae79dc312b  node-v18.20.2-linux-x64.tar.xz
9d2e3bcf978c511e8e635686623da2ea59efe1b9111e58ba8f23e531ffa65028  node-v18.20.2-win-x64.7z
1b7dde318fad3110db1d597184e78d327816e61eef340323765d86f7481babe6  node-v18.20.2-win-x64.zip
6327b08558db40b5426f814dc24afdc4e290ec29ca6f3dd36b8b43dd1862e2af  node-v18.20.2-win-x86.7z
7fde182306cb446dbecb732b897fe740d935d848810fed2aa87f56e2e31ea32b  node-v18.20.2-win-x86.zip
e2ea83c8a392bb46e1841eca510f600cfa8c5dc0750d29d42fcf67b5672ac86b  node-v18.20.2-x64.msi
e7a46aba0fe62db5fe3a81a85561e2a202bc90d637fc2eb7569ad68ad50d383a  node-v18.20.2-x86.msi
7cc83750a77ff2d4666c75d08e01f3027a4ab412894fe077e62e675fac739b11  node-v18.20.2.pkg
68c165b9ceb7bc69dcdc75c6099723edb5ff0509215959af0775ed426174c404  node-v18.20.2.tar.gz
8aaea7c9c7e927fb09d91498da311b6e4d18233390e23c723a53b891fad4c73f  node-v18.20.2.tar.xz
797de9af018be0ad307cdd22ce4451c17c2dfb27e154b4ad475147d42872bdde  win-x64/node.exe
64d93225aaece04e3cd45177d6dea2b22df49e127281fefa3ade43ac46a36cc6  win-x64/node.lib
cffbcf594d0006eaad4045d7bc4995a09a8003843f95fda44b59802a136e1e99  win-x64/node_pdb.7z
0017d7b5ea6faa281b559a002f8b52042099cad98c82e6b22b5767f6b0f15015  win-x64/node_pdb.zip
adb9e06c6f51b6eab819abd92b345d372b432a38ea130b698f81aab7c57641f1  win-x86/node.exe
df34047e8ae646e6f43d76ecbec9709a185f29e01f49b377c4c46070cacc2859  win-x86/node.lib
2316a8b568e4d30201faf627026f008d112482bb04308e1b86acea6c9a886b5c  win-x86/node_pdb.7z
c35ab3d6ca6500988b326817c8921d89b1eccc5d11cef0cc9b6cd672030744a4  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmYWvnAACgkQi+q0389V
XvRMkQv/f3bvkK2Q1jjsBGN+STmkeOrusk2zykA5ypDxMookxZwFFPHQxGqVJY4D
hNsoYEYEbhnPcM+cHp4ba4GKfYtjJyUACStwDRzO6lFI6nLZs0FrSSIjmc/2Q5Rp
IKuW2PQ5iAZz8M5PjI8Y4OMCDj1e4JChRgh1uLSkSLYg/G7YF/rcUDuVj4dHFdPb
61UTCqkI8kHVwTG4vMxJjCJYlHMkXmQ4VJ2ku8NHzPzBW3Vshdy0fISpImCGcSSJ
Bc995Roeh2hO5takxZ84m64YUxSGHDcBHow8i1uhpfIo8Ryow2ngDXjqsjXeiUbH
eqKz8tKd76/GQvGdWk/fKBDOEnLN5LTnu+aBQCCfSLSGjwIJErZ4+FZwaFqN+Dnq
y9+RRUYBKOgnZirOmzBqmMwJsSMq8MMKJxkSOWpb4RSQLsMNBNT9mHmB3v7GXFvt
JcSzij7LI/9cbmjdvACUJXAKY2eVkIhU36kpgJ1G12w2Kv06uts4uMNWj2ImEU9c
/i6OcSNN
=LyPd
-----END PGP SIGNATURE-----
```
