Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 16.4.1 (Current)

Node.js 16.4.1 fixes two security vulnerabilities: an out-of-bounds read in libuv and Windows installer permission issues that could enable local privilege escalation.

Announced

Node.js · Fixed in 16.4.1Windows installer · Fixed in 16.4.1CVE-2021-22918CVE-2021-22921
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)

Node.js

Node.js 16.4.1 (Current)
Affected versions
Not stated in this extraction
Fixed versions
16.4.1
Node.js 16.4.1 (Current)
Prerequisites
Not stated in this extraction

Windows installer

CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
Affected versions
Not stated in this extraction
Fixed versions
16.4.1
Windows 64-bit Installer: https://nodejs.org/dist/v16.4.1/node-v16.4.1-x64.msi
Prerequisites
under certain conditions on Windows platforms
Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms.
Related CVEs
CVE-2021-22918
CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
CVE-2021-22921
CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)

Publisher severity

No explicit severity was extracted.

Event
#38959 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 14.17.2 (LTS)

Node.js 14.17.2 (LTS) fixes vulnerabilities involving an out-of-bounds read in libuv and Windows installer privilege escalation.

Announced

Node.js · Fixed in Node.js 14.17.2CVE-2021-22918CVE-2021-22921
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)

Node.js

Node.js 14.17.2 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
Node.js 14.17.2
Node.js 14.17.2 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-22918
CVE-2021-22918: libuv upgrade - Out of bounds read
CVE-2021-22921
CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation

Publisher severity

No explicit severity was extracted.

Event
#38566 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

July 2021 Security Releases

Node.js released security updates for the 12.x, 14.x, and 16.x release lines addressing vulnerabilities in libuv, the Windows installer, and npm dependencies.

Announced

Node.js · Fixed in Node.js v12.22.2 (LTS), Node.js v14.17.2 (LTS), Node.js v16.4.1 (LTS)CVE-2021-22918CVE-2021-22921CVE-2021-27290CVE-2021-23362
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issues.

Node.js

Node.js release lines
Affected versions
All versions of the 16.x, 14.x, and 12.x releases lines
Impacts: All versions of the 16.x, 14.x, and 12.x releases lines
All versions of the 12.x release line
Impacts: All versions of the 12.x release line
Versions of the 14.x release line before 14.17.0
Versions of the 14.x release line before 14.17.0 which included an update to the latest npm 6.
Fixed versions
Node.js v12.22.2 (LTS)
Node.js v12.22.2 (LTS)
Node.js v14.17.2 (LTS)
Node.js v14.17.2 (LTS)
Node.js v16.4.1 (LTS)
Node.js v16.4.1 (LTS)
Prerequisites
Windows platforms
under certain conditions on Windows platforms
Related CVEs
CVE-2021-22918
Out of bounds read (Medium) (CVE-2021-22918)
CVE-2021-22921
Node Installer Local Privilege Escalation (Medium) (CVE-2021-22921)
CVE-2021-27290
Regular Expression Denial of Service (ReDoS) (High) (CVE-2021-27290)
CVE-2021-23362
Regular Expression Denial of Service (ReDoS) (Medium) (CVE-2021-23362)

Publisher severity

No explicit severity was extracted.

Event
#38385 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 12.22.2 (LTS)

Node.js 12.22.2 fixes multiple listed vulnerabilities, including out-of-bounds read, Windows local privilege escalation, and denial-of-service flaws in npm dependencies.

Announced

Node.js · Fixed in 12.22.2CVE-2021-22918CVE-2021-22921CVE-2021-27290CVE-2021-23362
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)

Node.js

Node.js 12.22.2 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.22.2
Node.js 12.22.2 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-22918
CVE-2021-22918: libuv upgrade
CVE-2021-22921
CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
CVE-2021-27290
CVE-2021-27290: npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High)
CVE-2021-23362
CVE-2021-23362: npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium)

Publisher severity

No explicit severity was extracted.

Event
#38384 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement