Security feed

25 October 2026

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 16.11.1 (Current)

Node.js 16.11.1 addresses two HTTP request smuggling issues involving spaces in headers and parsing chunked request bodies.

Announced 12 Oct 2021

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)

Node.js

Node.js 16.11.1 (Current)

Affected versions: Not stated in this extraction
Fixed versions: 16.11.1
Node.js 16.11.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-22959
CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
CVE-2021-22960
CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)

Publisher severity

No explicit severity was extracted.

Event: #36236 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:52:23 GMT
Publisher date: Tue, 12 Oct 2021 15:35:28 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 14.18.1 (LTS)

Node.js 14.18.1 addresses two HTTP request smuggling issues involving spaces before header colons and chunked request body parsing.

Announced 12 Oct 2021

Node.js · Fixed in 14.18.1 CVE-2021-22959 CVE-2021-22960

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 14.18.1 (LTS) Notable changes CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)

Node.js

Node.js 14.18.1 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 14.18.1
Node.js 14.18.1 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-22959
CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
CVE-2021-22960
CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)

Publisher severity

No explicit severity was extracted.

Event: #35957 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:47:23 GMT
Publisher date: Tue, 12 Oct 2021 15:35:37 GMT

Read the original announcement

patchSecurity fix · UnratedNode.js announcements25 Oct 2026

Node.js 12.22.7 (LTS)

Node.js 12.22.7 (LTS) addresses HTTP request smuggling issues involving spaces in headers and chunked request body parsing.

Announced 12 Oct 2021

Node.js · Fixed in 12.22.7 CVE-2021-22959 CVE-2021-22960

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Node.js 12.22.7 (LTS) Notable changes CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS).

Node.js

Node.js 12.22.7 (LTS)

Affected versions: Not stated in this extraction
Fixed versions: 12.22.7
Node.js 12.22.7 (LTS)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-22959
CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
CVE-2021-22960
CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)

Publisher severity

No explicit severity was extracted.

Event: #35956 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:47:23 GMT
Publisher date: Tue, 12 Oct 2021 15:35:54 GMT

Read the original announcement

patchMediumFix availableNode.js announcements25 Oct 2026

October 12th 2021 Security Releases

Node.js released updates addressing two HTTP request smuggling issues across the 12.x, 14.x, and 16.x release lines.

Announced 12 Oct 2021

Node.js · Fixed in Node.js v12.22.7 (LTS), Node.js v14.18.1 (LTS), Node.js v16.11.1 (Current)CVE-2021-22959 CVE-2021-22960

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v16.x, v14.x, and v12.x Node.js release lines for the following issues.

Node.js

Node.js v12.22.7 (LTS)

Affected versions: All versions of the 16.x, 14.x, and 12.x releases lines.
Impacts: All versions of the 16.x, 14.x, and 12.x releases lines.
Fixed versions: Node.js v12.22.7 (LTS)
Node.js v12.22.7 (LTS)
Node.js v14.18.1 (LTS)
Node.js v14.18.1 (LTS)
Node.js v16.11.1 (Current)
Node.js v16.11.1 (Current)
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2021-22959
HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959)
CVE-2021-22960
HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960)

Publisher severity

medium

Two medium severity issues

Event: #35775 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 09:44:22 GMT
Publisher date: Tue, 12 Oct 2021 16:00:00 GMT

Read the original announcement