Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

August 2021 Security Releases

Security updates address three vulnerabilities across the Node.js 12.x, 14.x, and 16.x release lines. Updated releases are Node.js v12.22.5, v14.17.5, and v16.6.2.

Announced

Node.js · Fixed in Node.js v12.22.5 (LTS)Node.js · Fixed in Node.js v14.17.5 (LTS)Node.js · Fixed in Node.js v16.6.2 (Current)CVE-2021-22931CVE-2021-22940CVE-2021-22939
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issues.

Node.js

Node.js v12.22.5 (LTS)
Affected versions
All versions of the 16.x, 14.x, and 12.x releases lines
Impacts: All versions of the 16.x, 14.x, and 12.x releases lines
Fixed versions
Node.js v12.22.5 (LTS)
Node.js v12.22.5 (LTS)
Prerequisites
Not stated in this extraction

Node.js

Node.js v14.17.5 (LTS)
Affected versions
All versions of the 16.x, 14.x, and 12.x releases lines
Impacts: All versions of the 16.x, 14.x, and 12.x releases lines
Fixed versions
Node.js v14.17.5 (LTS)
Node.js v14.17.5 (LTS)
Prerequisites
Not stated in this extraction

Node.js

Node.js v16.6.2 (Current)
Affected versions
All versions of the 16.x, 14.x, and 12.x releases lines
Impacts: All versions of the 16.x, 14.x, and 12.x releases lines
Fixed versions
Node.js v16.6.2 (Current)
Node.js v16.6.2 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-22931
(CVE-2021-22931)
CVE-2021-22940
(CVE-2021-22940)
CVE-2021-22939
(CVE-2021-22939)

Publisher severity

No explicit severity was extracted.

Event
#37047 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 12.22.5 (LTS)

Node.js 12.22.5 (LTS) addresses vulnerabilities involving domain-name handling, HTTP/2 stream cancellation, and HTTPS certificate validation.

Announced

Node.js · Fixed in 12.22.5CVE-2021-3672CVE-2021-22931CVE-2021-22940CVE-2021-22939
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)

Node.js

Node.js 12.22.5 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.22.5
Node.js 12.22.5 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-3672
CVE-2021-3672/CVE-2021-22931
CVE-2021-22931
CVE-2021-3672/CVE-2021-22931
CVE-2021-22940
CVE-2021-22940: Use after free on close http2 on stream canceling (High)
CVE-2021-22939
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)

Publisher severity

No explicit severity was extracted.

Event
#37020 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 14.17.5 (LTS)

Node.js 14.17.5 addresses vulnerabilities involving DNS hostname validation, HTTP/2 stream cancellation, and HTTPS certificate validation. The release also includes a follow-up fix for CVE-2021-22930.

Announced

Node.js · Fixed in 14.17.5CVE-2021-3672CVE-2021-22931CVE-2021-22940CVE-2021-22939CVE-2021-22930
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix.

Node.js

Node.js 14.17.5 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
14.17.5
Node.js 14.17.5 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-3672
CVE-2021-3672/CVE-2021-22931
CVE-2021-22931
CVE-2021-3672/CVE-2021-22931
CVE-2021-22940
CVE-2021-22940: Use after free on close http2 on stream canceling (High)
CVE-2021-22939
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
CVE-2021-22930
This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix.

Publisher severity

No explicit severity was extracted.

Event
#36923 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 16.6.2 (Current)

Node.js 16.6.2 addresses reported security issues involving DNS hostname handling, HTTP/2 stream cancellation, and HTTPS certificate validation.

Announced

Node.js · Fixed in 16.6.2CVE-2021-3672CVE-2021-22931CVE-2021-22940CVE-2021-22939
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)

Node.js

Node.js 16.6.2 (Current)
Affected versions
Not stated in this extraction
Fixed versions
16.6.2
Node.js 16.6.2 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-3672
CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
CVE-2021-22931
CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
CVE-2021-22940
CVE-2021-22940: Use after free on close http2 on stream canceling (High)
CVE-2021-22939
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)

Publisher severity

No explicit severity was extracted.

Event
#36922 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement