Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 10.24.0 (LTS)

Node.js 10.24.0 fixes vulnerabilities involving HTTP/2 unknownProtocol handling, DNS rebinding in --inspect, and an OpenSSL integer overflow.

Announced

Node.js · Fixed in 10.24.0CVE-2021-22883CVE-2021-22884CVE-2021-23840
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion

Node.js

Node.js 10.24.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
10.24.0
Node.js 10.24.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-22883
CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion
CVE-2021-22884
CVE-2021-22884: DNS rebinding in --inspect
CVE-2021-23840
CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate

Publisher severity

No explicit severity was extracted.

Event
#40842 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 15.10.0 (Current)

Node.js 15.10.0 fixes vulnerabilities involving HTTP/2 unknownProtocol handling and DNS rebinding in --inspect, and includes an OpenSSL update related to an integer-overflow vulnerability.

Announced

Node.js · Fixed in 15.10.0CVE-2021-22883CVE-2021-22884CVE-2021-23840
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion

Node.js

Node.js 15.10.0 (Current)
Affected versions
Not stated in this extraction
Fixed versions
15.10.0
Node.js 15.10.0 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-22883
CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion
CVE-2021-22884
CVE-2021-22884: DNS rebinding in --inspect
CVE-2021-23840
CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate

Publisher severity

No explicit severity was extracted.

Event
#40725 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 12.21.0 (LTS)

Node.js 12.21.0 (LTS) includes fixes for vulnerabilities involving HTTP/2 resource exhaustion, DNS rebinding in the inspector, and an OpenSSL integer overflow.

Announced

Node.js · Fixed in 12.21.0CVE-2021-22883CVE-2021-22884CVE-2021-23840
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion

Node.js

Node.js 12.21.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.21.0
Node.js 12.21.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-22883
CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion
CVE-2021-22884
CVE-2021-22884: DNS rebinding in --inspect
CVE-2021-23840
CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate

Publisher severity

No explicit severity was extracted.

Event
#40700 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 14.16.0 (LTS)

Node.js 14.16.0 (LTS) fixes vulnerabilities involving HTTP/2, DNS rebinding in the inspector, and OpenSSL.

Announced

Node.js · Fixed in 14.16.0CVE-2021-22883CVE-2021-22884CVE-2021-23840
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion

Node.js

Node.js 14.16.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
14.16.0
Node.js 14.16.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-22883
CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion
CVE-2021-22884
CVE-2021-22884: DNS rebinding in --inspect
CVE-2021-23840
CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate

Publisher severity

No explicit severity was extracted.

Event
#40563 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

February 2021 Security Releases

Security updates address denial-of-service, DNS rebinding, and OpenSSL integer-overflow vulnerabilities affecting Node.js release lines 10.x, 12.x, 14.x, and 15.x.

Announced

Node.js · Fixed in Node.js v10.24.0 (LTS), Node.js v12.21.0 (LTS), Node.js v14.16.0 (LTS), Node.js v15.10.0 (Current)CVE-2021-22883CVE-2021-22884CVE-2021-23840
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for v10.x, v12.x, v14.x and v15.x Node.js release lines for the following issues.

Node.js

Node.js v10.24.0 (LTS)
Affected versions
All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Fixed versions
Node.js v10.24.0 (LTS)
Node.js v10.24.0 (LTS)
Node.js v12.21.0 (LTS)
Node.js v12.21.0 (LTS)
Node.js v14.16.0 (LTS)
Node.js v14.16.0 (LTS)
Node.js v15.10.0 (Current)
Node.js v15.10.0 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-22883
HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (Critical) (CVE-2021-22883)
CVE-2021-22884
DNS rebinding in --inspect (CVE-2021-22884)
CVE-2021-23840
OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840)

Publisher severity

No explicit severity was extracted.

Event
#40477 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement