Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 12.22.1 (LTS)

Node.js 12.22.1 includes fixes for OpenSSL and npm-related vulnerabilities.

Announced

Node.js · Fixed in 12.22.1CVE-2021-3450CVE-2021-3449CVE-2020-7774
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT

Node.js

Node.js 12.22.1 (LTS)
Affected versions
12.x
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Fixed versions
12.22.1
Node.js 12.22.1 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-3450
CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT
CVE-2021-3449
CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing
CVE-2020-7774
CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution

Publisher severity

No explicit severity was extracted.

Event
#41953 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 14.16.1 (LTS)

Node.js 14.16.1 updates npm and OpenSSL and fixes listed vulnerabilities affecting Node.js release lines.

Announced

Node.js · Fixed in 14.16.1CVE-2021-3450CVE-2021-3449CVE-2020-7774
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)

Node.js

Node.js 14.16.1 (LTS)
Affected versions
All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
All versions of the 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 14.x, 12.x and 10.x releases lines
Fixed versions
14.16.1
Node.js 14.16.1 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-3450
CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)
CVE-2021-3449
CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High)
CVE-2020-7774
CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High)

Publisher severity

No explicit severity was extracted.

Event
#40600 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

April 2021 Security Releases

Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.

Announced

Node.js · Fixed in v10.24.1, v12.22.1, v14.16.1, v15.14.0npmCVE-2021-3450CVE-2021-3449CVE-2020-7774
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.

Node.js

Node.js v10.24.1 (LTS)
Affected versions
All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Fixed versions
v10.24.1
Node.js v10.24.1 (LTS)
v12.22.1
Node.js v12.22.1 (LTS)
v14.16.1
Node.js v14.16.1 (LTS)
v15.14.0
Node.js v15.14.0 (Current)
Prerequisites
Not stated in this extraction

npm

npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)
Affected versions
All versions of the 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 14.x, 12.x and 10.x releases lines
Fixed versions
Not stated in this extraction
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-3450
CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)
CVE-2021-3449
NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)
CVE-2020-7774
Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)

Publisher severity

No explicit severity was extracted.

Event
#39735 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 10.24.1 (LTS)

Node.js 10.24.1 fixes vulnerabilities involving OpenSSL and npm’s y18n module.

Announced

Node.js · Fixed in 10.24.1CVE-2021-3450CVE-2021-3449CVE-2020-7774
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulerabilties fixed: CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)

Node.js

Node.js 10.24.1 (LTS)
Affected versions
All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
All versions of the 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 14.x, 12.x and 10.x releases lines
Fixed versions
10.24.1
Node.js 10.24.1 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-3450
CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)
CVE-2021-3449
CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High)
CVE-2020-7774
CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High)

Publisher severity

No explicit severity was extracted.

Event
#39635 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement