25 October 2026 Node.js 15.5.1 fixes a TLS use-after-free vulnerability and HTTP request smuggling caused by duplicate request headers.
Announced 4 Jan 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2020-8265: use-after-free in TLSWrap (High) Node.js Node.js 15.5.1 (Current)
Affected versions Not stated in this extraction Fixed versions 15.5.1 Node.js 15.5.1 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2020-8265 CVE-2020-8265: use-after-free in TLSWrap (High) CVE-2020-8287 CVE-2020-8287: HTTP Request Smuggling in nodejs (Low) Publisher severity No explicit severity was extracted.
Event #41631 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:22:41 GMT
Publisher date Mon, 04 Jan 2021 18:15:24 GMT Read the original announcement Node.js 10.23.1 (LTS) is a security release fixing TLS use-after-free, HTTP request smuggling, and an OpenSSL null-pointer dereference vulnerability.
Announced 4 Jan 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Vulnerabilities fixed: Node.js Node.js 10.23.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 10.23.1 Node.js 10.23.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2020-8265 CVE-2020-8265: use-after-free in TLSWrap (High) CVE-2020-8287 CVE-2020-8287: HTTP Request Smuggling in nodejs CVE-2020-1971 CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High) Publisher severity No explicit severity was extracted.
Event #41610 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:22:25 GMT
Publisher date Mon, 04 Jan 2021 18:20:48 GMT Read the original announcement Node.js 12.20.1 is a security release that fixes TLS use-after-free, HTTP request smuggling, and an OpenSSL vulnerability reachable through Node.js.
Announced 4 Jan 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This is a security release. Node.js Node.js 12.20.1 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.20.1 Node.js 12.20.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2020-8265 CVE-2020-8265: use-after-free in TLSWrap (High) CVE-2020-8287 CVE-2020-8287: HTTP Request Smuggling in nodejs CVE-2020-1971 CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High) Publisher severity No explicit severity was extracted.
Event #41505 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:20:33 GMT
Publisher date Mon, 04 Jan 2021 18:23:08 GMT Read the original announcement Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versions.
Announced 4 Jan 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Security releases available Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues. Node.js Node.js v10.23.1 (LTS) Affected versions All versions of the 15.x, 14.x, 12.x and 10.x releases lines Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines Fixed versions Node.js v10.23.1 (LTS) Node.js v10.23.1 (LTS) Node.js v12.20.1 (LTS) Node.js v12.20.1 (LTS) Node.js v14.15.4 (LTS) Node.js v14.15.4 (LTS) Node.js v15.5.1 (Current) Node.js v15.5.1 (Current)
Prerequisites Not stated in this extraction OpenSSL OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971) Affected versions All versions of the 14.x, 12.x and 10.x release lines Impacts: All versions of the 14.x, 12.x and 10.x release lines Versions of the 15.x line before 15.5.0 Versions of the 15.x line before 15.5.0 which included an update to the latest OpenSSL.
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2020-8265 use-after-free in TLSWrap (High) (CVE-2020-8265) CVE-2020-8287 HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287) CVE-2020-1971 OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971) Publisher severity No explicit severity was extracted.
Event #41324 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:17:46 GMT
Publisher date Mon, 04 Jan 2021 19:30:00 GMT Read the original announcement Node.js 14.15.5 is a release containing a V8 backport and other updates; the announcement explicitly says Node.js is not believed to be vulnerable to CVE-2021-21148.
Announced 9 Feb 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Node.js 14.15.5 (LTS) Node.js Node.js 14.15.5 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.15.5 Node.js 14.15.5 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-21148 Node.js is not believed to be vulnerable to CVE-2021-21148. Publisher severity No explicit severity was extracted.
Event #41023 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:12:22 GMT
Publisher date Tue, 09 Feb 2021 16:54:12 GMT Read the original announcement Node.js 10.24.0 fixes vulnerabilities involving HTTP/2 unknownProtocol handling, DNS rebinding in --inspect, and an OpenSSL integer overflow.
Announced 23 Feb 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion Node.js Node.js 10.24.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 10.24.0 Node.js 10.24.0 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22883 CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion CVE-2021-22884 CVE-2021-22884: DNS rebinding in --inspect CVE-2021-23840 CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate Publisher severity No explicit severity was extracted.
Event #40842 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:09:31 GMT
Publisher date Tue, 23 Feb 2021 12:58:46 GMT Read the original announcement Node.js 15.10.0 fixes vulnerabilities involving HTTP/2 unknownProtocol handling and DNS rebinding in --inspect, and includes an OpenSSL update related to an integer-overflow vulnerability.
Announced 23 Feb 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion Node.js Node.js 15.10.0 (Current)
Affected versions Not stated in this extraction Fixed versions 15.10.0 Node.js 15.10.0 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22883 CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion CVE-2021-22884 CVE-2021-22884: DNS rebinding in --inspect CVE-2021-23840 CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate Publisher severity No explicit severity was extracted.
Event #40725 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:07:44 GMT
Publisher date Tue, 23 Feb 2021 13:01:31 GMT Read the original announcement Node.js 12.21.0 (LTS) includes fixes for vulnerabilities involving HTTP/2 resource exhaustion, DNS rebinding in the inspector, and an OpenSSL integer overflow.
Announced 23 Feb 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion Node.js Node.js 12.21.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.21.0 Node.js 12.21.0 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22883 CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion CVE-2021-22884 CVE-2021-22884: DNS rebinding in --inspect CVE-2021-23840 CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate Publisher severity No explicit severity was extracted.
Event #40700 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:07:24 GMT
Publisher date Tue, 23 Feb 2021 13:01:45 GMT Read the original announcement Node.js 14.16.1 updates npm and OpenSSL and fixes listed vulnerabilities affecting Node.js release lines.
Announced 6 Apr 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) Node.js Node.js 14.16.1 (LTS) Affected versions All versions of the 15.x, 14.x, 12.x and 10.x releases lines Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines All versions of the 14.x, 12.x and 10.x releases lines Impacts: All versions of the 14.x, 12.x and 10.x releases lines Fixed versions 14.16.1 Node.js 14.16.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-3450 CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) CVE-2021-3449 CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High) CVE-2020-7774 CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High) Publisher severity No explicit severity was extracted.
Event #40600 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:05:52 GMT
Publisher date Tue, 06 Apr 2021 20:09:51 GMT Read the original announcement Node.js 14.16.0 (LTS) fixes vulnerabilities involving HTTP/2, DNS rebinding in the inspector, and OpenSSL.
Announced 23 Feb 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion Node.js Node.js 14.16.0 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.16.0 Node.js 14.16.0 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22883 CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion CVE-2021-22884 CVE-2021-22884: DNS rebinding in --inspect CVE-2021-23840 CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate Publisher severity No explicit severity was extracted.
Event #40563 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:05:22 GMT
Publisher date Tue, 23 Feb 2021 13:02:35 GMT Read the original announcement Security updates address denial-of-service, DNS rebinding, and OpenSSL integer-overflow vulnerabilities affecting Node.js release lines 10.x, 12.x, 14.x, and 15.x.
Announced 23 Feb 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Security releases available Updates are now available for v10.x, v12.x, v14.x and v15.x Node.js release lines for the following issues. Node.js Node.js v10.24.0 (LTS) Affected versions All versions of the 15.x, 14.x, 12.x and 10.x releases lines Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines Fixed versions Node.js v10.24.0 (LTS) Node.js v10.24.0 (LTS) Node.js v12.21.0 (LTS) Node.js v12.21.0 (LTS) Node.js v14.16.0 (LTS) Node.js v14.16.0 (LTS) Node.js v15.10.0 (Current) Node.js v15.10.0 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22883 HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (Critical) (CVE-2021-22883) CVE-2021-22884 DNS rebinding in --inspect (CVE-2021-22884) CVE-2021-23840 OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840) Publisher severity No explicit severity was extracted.
Event #40477 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 11:03:23 GMT
Publisher date Tue, 23 Feb 2021 13:30:00 GMT Read the original announcement Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.
Announced 6 Apr 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues. Node.js Node.js v10.24.1 (LTS) Affected versions All versions of the 15.x, 14.x, 12.x and 10.x releases lines Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines Fixed versions v10.24.1 Node.js v10.24.1 (LTS) v12.22.1 Node.js v12.22.1 (LTS) v14.16.1 Node.js v14.16.1 (LTS) v15.14.0 Node.js v15.14.0 (Current)
Prerequisites Not stated in this extraction npm npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774) Affected versions All versions of the 14.x, 12.x and 10.x releases lines Impacts: All versions of the 14.x, 12.x and 10.x releases lines
Fixed versions Not stated in this extraction
Prerequisites Not stated in this extraction Related CVEs CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450) CVE-2021-3449 NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449) CVE-2020-7774 Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774) Publisher severity No explicit severity was extracted.
Event #39735 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:51:27 GMT
Publisher date Tue, 06 Apr 2021 20:51:00 GMT Read the original announcement Node.js 10.24.1 fixes vulnerabilities involving OpenSSL and npm’s y18n module.
Announced 6 Apr 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulerabilties fixed: CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) Node.js Node.js 10.24.1 (LTS) Affected versions All versions of the 15.x, 14.x, 12.x and 10.x releases lines Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines All versions of the 14.x, 12.x and 10.x releases lines Impacts: All versions of the 14.x, 12.x and 10.x releases lines Fixed versions 10.24.1 Node.js 10.24.1 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-3450 CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) CVE-2021-3449 CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High) CVE-2020-7774 CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High) Publisher severity No explicit severity was extracted.
Event #39635 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:49:22 GMT
Publisher date Tue, 06 Apr 2021 20:09:17 GMT Read the original announcement Node.js 16.4.1 fixes two security vulnerabilities: an out-of-bounds read in libuv and Windows installer permission issues that could enable local privilege escalation.
Announced 1 Jul 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium) Node.js Node.js 16.4.1 (Current)
Affected versions Not stated in this extraction Fixed versions 16.4.1 Node.js 16.4.1 (Current)
Prerequisites Not stated in this extraction Windows installer CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
Affected versions Not stated in this extraction Fixed versions 16.4.1 Windows 64-bit Installer: https://nodejs.org/dist/v16.4.1/node-v16.4.1-x64.msi Prerequisites under certain conditions on Windows platforms Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. Related CVEs CVE-2021-22918 CVE-2021-22918: libuv upgrade - Out of bounds read (Medium) CVE-2021-22921 CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium) Publisher severity No explicit severity was extracted.
Event #38959 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:38:23 GMT
Publisher date Thu, 01 Jul 2021 15:40:16 GMT Read the original announcement Node.js 14.17.2 (LTS) fixes vulnerabilities involving an out-of-bounds read in libuv and Windows installer privilege escalation.
Announced 1 Jul 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium) Node.js Node.js 14.17.2 (LTS)
Affected versions Not stated in this extraction Fixed versions Node.js 14.17.2 Node.js 14.17.2 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22918 CVE-2021-22918: libuv upgrade - Out of bounds read CVE-2021-22921 CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation Publisher severity No explicit severity was extracted.
Event #38566 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:31:22 GMT
Publisher date Thu, 01 Jul 2021 15:44:53 GMT Read the original announcement Node.js released security updates for the 12.x, 14.x, and 16.x release lines addressing vulnerabilities in libuv, the Windows installer, and npm dependencies.
Announced 1 Jul 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issues. Node.js Node.js release lines Affected versions All versions of the 16.x, 14.x, and 12.x releases lines Impacts: All versions of the 16.x, 14.x, and 12.x releases lines All versions of the 12.x release line Impacts: All versions of the 12.x release line Versions of the 14.x release line before 14.17.0 Versions of the 14.x release line before 14.17.0 which included an update to the latest npm 6. Fixed versions Node.js v12.22.2 (LTS) Node.js v12.22.2 (LTS) Node.js v14.17.2 (LTS) Node.js v14.17.2 (LTS) Node.js v16.4.1 (LTS) Node.js v16.4.1 (LTS) Prerequisites Windows platforms under certain conditions on Windows platforms Related CVEs CVE-2021-22918 Out of bounds read (Medium) (CVE-2021-22918) CVE-2021-22921 Node Installer Local Privilege Escalation (Medium) (CVE-2021-22921) CVE-2021-27290 Regular Expression Denial of Service (ReDoS) (High) (CVE-2021-27290) CVE-2021-23362 Regular Expression Denial of Service (ReDoS) (Medium) (CVE-2021-23362) Publisher severity No explicit severity was extracted.
Event #38385 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:28:23 GMT
Publisher date Thu, 01 Jul 2021 16:00:00 GMT Read the original announcement Node.js 12.22.2 fixes multiple listed vulnerabilities, including out-of-bounds read, Windows local privilege escalation, and denial-of-service flaws in npm dependencies.
Announced 1 Jul 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium) Node.js Node.js 12.22.2 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.2 Node.js 12.22.2 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22918 CVE-2021-22918: libuv upgrade CVE-2021-22921 CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium) CVE-2021-27290 CVE-2021-27290: npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High) CVE-2021-23362 CVE-2021-23362: npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium) Publisher severity No explicit severity was extracted.
Event #38384 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:28:22 GMT
Publisher date Thu, 01 Jul 2021 15:42:17 GMT Read the original announcement Security updates address three vulnerabilities across the Node.js 12.x, 14.x, and 16.x release lines. Updated releases are Node.js v12.22.5, v14.17.5, and v16.6.2.
Announced 11 Aug 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issues. Node.js Node.js v12.22.5 (LTS) Affected versions All versions of the 16.x, 14.x, and 12.x releases lines Impacts: All versions of the 16.x, 14.x, and 12.x releases lines Fixed versions Node.js v12.22.5 (LTS) Node.js v12.22.5 (LTS)
Prerequisites Not stated in this extraction Node.js Node.js v14.17.5 (LTS) Affected versions All versions of the 16.x, 14.x, and 12.x releases lines Impacts: All versions of the 16.x, 14.x, and 12.x releases lines Fixed versions Node.js v14.17.5 (LTS) Node.js v14.17.5 (LTS)
Prerequisites Not stated in this extraction Node.js Node.js v16.6.2 (Current) Affected versions All versions of the 16.x, 14.x, and 12.x releases lines Impacts: All versions of the 16.x, 14.x, and 12.x releases lines Fixed versions Node.js v16.6.2 (Current) Node.js v16.6.2 (Current)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-22931 (CVE-2021-22931) CVE-2021-22940 (CVE-2021-22940) CVE-2021-22939 (CVE-2021-22939) Publisher severity No explicit severity was extracted.
Event #37047 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:05:46 GMT
Publisher date Wed, 11 Aug 2021 16:00:00 GMT Read the original announcement Node.js 12.22.5 (LTS) addresses vulnerabilities involving domain-name handling, HTTP/2 stream cancellation, and HTTPS certificate validation.
Announced 11 Aug 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High) Node.js Node.js 12.22.5 (LTS)
Affected versions Not stated in this extraction Fixed versions 12.22.5 Node.js 12.22.5 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-3672 CVE-2021-3672/CVE-2021-22931 CVE-2021-22931 CVE-2021-3672/CVE-2021-22931 CVE-2021-22940 CVE-2021-22940: Use after free on close http2 on stream canceling (High) CVE-2021-22939 CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low) Publisher severity No explicit severity was extracted.
Event #37020 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:05:23 GMT
Publisher date Wed, 11 Aug 2021 16:41:05 GMT Read the original announcement Node.js 14.17.5 addresses vulnerabilities involving DNS hostname validation, HTTP/2 stream cancellation, and HTTPS certificate validation. The release also includes a follow-up fix for CVE-2021-22930.
Announced 11 Aug 2021
Evidence and details + These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. Node.js Node.js 14.17.5 (LTS)
Affected versions Not stated in this extraction Fixed versions 14.17.5 Node.js 14.17.5 (LTS)
Prerequisites Not stated in this extraction Related CVEs CVE-2021-3672 CVE-2021-3672/CVE-2021-22931 CVE-2021-22931 CVE-2021-3672/CVE-2021-22931 CVE-2021-22940 CVE-2021-22940: Use after free on close http2 on stream canceling (High) CVE-2021-22939 CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low) CVE-2021-22930 This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. Publisher severity No explicit severity was extracted.
Event #36923 · Revision 1
Added to Heist Feed Sun, 25 Oct 2026 10:03:25 GMT
Publisher date Wed, 11 Aug 2021 16:41:40 GMT Read the original announcement 