Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 14.15.4 (LTS)

Node.js 14.15.4 (LTS) fixes three listed vulnerabilities involving OpenSSL, TLSWrap, and HTTP request smuggling.

Announced 4 Jan 2021

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)

Node.js

Node.js 14.15.4 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 14.15.4
Node.js 14.15.4 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2020-1971
CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)
CVE-2020-8265
CVE-2020-8265: use-after-free in TLSWrap (High)
CVE-2020-8287
CVE-2020-8287: HTTP Request Smuggling in nodejs (Low)

Publisher severity

No explicit severity was extracted.

Event: #41729 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 11:24:23 GMT
Publisher date: Mon, 04 Jan 2021 18:17:46 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 15.5.1 (Current)

Node.js 15.5.1 fixes a TLS use-after-free vulnerability and HTTP request smuggling caused by duplicate request headers.

Announced 4 Jan 2021

Node.js · Fixed in 15.5.1 CVE-2020-8265 CVE-2020-8287

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2020-8265: use-after-free in TLSWrap (High)

Node.js

Node.js 15.5.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 15.5.1
Node.js 15.5.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2020-8265
CVE-2020-8265: use-after-free in TLSWrap (High)
CVE-2020-8287
CVE-2020-8287: HTTP Request Smuggling in nodejs (Low)

Publisher severity

No explicit severity was extracted.

Event: #41631 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 11:22:41 GMT
Publisher date: Mon, 04 Jan 2021 18:15:24 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 10.23.1 (LTS)

Node.js 10.23.1 (LTS) is a security release fixing TLS use-after-free, HTTP request smuggling, and an OpenSSL null-pointer dereference vulnerability.

Announced 4 Jan 2021

Node.js · Fixed in 10.23.1 CVE-2020-8265 CVE-2020-8287 CVE-2020-1971

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Vulnerabilities fixed:

Node.js

Node.js 10.23.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 10.23.1
Node.js 10.23.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2020-8265
CVE-2020-8265: use-after-free in TLSWrap (High)
CVE-2020-8287
CVE-2020-8287: HTTP Request Smuggling in nodejs
CVE-2020-1971
CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)

Publisher severity

No explicit severity was extracted.

Event: #41610 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 11:22:25 GMT
Publisher date: Mon, 04 Jan 2021 18:20:48 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 12.20.1 (LTS)

Node.js 12.20.1 is a security release that fixes TLS use-after-free, HTTP request smuggling, and an OpenSSL vulnerability reachable through Node.js.

Announced 4 Jan 2021

Node.js · Fixed in 12.20.1 CVE-2020-8265 CVE-2020-8287 CVE-2020-1971

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 12.20.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 12.20.1
Node.js 12.20.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2020-8265
CVE-2020-8265: use-after-free in TLSWrap (High)
CVE-2020-8287
CVE-2020-8287: HTTP Request Smuggling in nodejs
CVE-2020-1971
CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)

Publisher severity

No explicit severity was extracted.

Event: #41505 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 11:20:33 GMT
Publisher date: Mon, 04 Jan 2021 18:23:08 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

January 2021 Security Releases

Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versions.

Announced 4 Jan 2021

Node.js · Fixed in Node.js v10.23.1 (LTS), Node.js v12.20.1 (LTS), Node.js v14.15.4 (LTS), Node.js v15.5.1 (Current)OpenSSL CVE-2020-8265 CVE-2020-8287 CVE-2020-1971

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.

Node.js

Node.js v10.23.1 (LTS)

Affected versions: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Fixed versions: Node.js v10.23.1 (LTS)
Node.js v10.23.1 (LTS)
Node.js v12.20.1 (LTS)
Node.js v12.20.1 (LTS)
Node.js v14.15.4 (LTS)
Node.js v14.15.4 (LTS)
Node.js v15.5.1 (Current)
Node.js v15.5.1 (Current)
Prerequisites: Not stated in this extraction

OpenSSL

OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

Affected versions: All versions of the 14.x, 12.x and 10.x release lines
Impacts: All versions of the 14.x, 12.x and 10.x release lines
Versions of the 15.x line before 15.5.0
Versions of the 15.x line before 15.5.0 which included an update to the latest OpenSSL.
Fixed versions: Not stated in this extraction
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2020-8265
use-after-free in TLSWrap (High) (CVE-2020-8265)
CVE-2020-8287
HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)
CVE-2020-1971
OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

Publisher severity

No explicit severity was extracted.

Event: #41324 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 11:17:46 GMT
Publisher date: Mon, 04 Jan 2021 19:30:00 GMT

Read the original announcement