Security feed

patchSecurity fix · UnratedNode.js announcements

August 31 2021 Security Releases

Security updates for Node.js 12.x and 14.x address vulnerabilities in node-tar and other issues. The announcement lists Node.js v12.22.6 and v14.17.6 as releases.

Announced

Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for v14.x, and v12.x Node.js release lines for the following issues.

Node.js

Node.js release lines
Affected versions
14.x
The 14.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues
12.x
The 12.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues
Fixed versions
v12.22.6
Node.js v12.22.6 (LTS)
v14.17.6
Node.js v14.17.6 (LTS)
Prerequisites
Not stated in this extraction

npm

npm 6 update - node-tar
Affected versions
npm 6
npm 6 update - node-tar
Fixed versions
Not stated in this extraction
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-37701
CVE-2021-37701
CVE-2021-37712
CVE-2021-37712
CVE-2021-37713
CVE-2021-37713
CVE-2021-32803
CVE-2021-32803
CVE-2021-32804
CVE-2021-32804

Publisher severity

No explicit severity was extracted.

Event
#36712 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 12.22.6 (LTS)

Node.js 12.22.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including issues associated with five listed CVEs.

Announced

Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804.

Node.js

Node.js 12.22.6 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.22.6
Node.js 12.22.6 (LTS)
Prerequisites
Not stated in this extraction

npm

deps: upgrade npm to 6.14.15
Affected versions
Not stated in this extraction
Fixed versions
6.14.15
deps: upgrade npm to 6.14.15
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2021-32803
node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804
CVE-2021-32804
node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804
CVE-2021-37701
CVE-2021-37701
CVE-2021-37712
CVE-2021-37712
CVE-2021-37713
CVE-2021-37713
CVE-2021-39134
CVE-2021-39134
CVE-2021-39135
CVE-2021-39135

Publisher severity

No explicit severity was extracted.

Event
#36619 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement