{"schema_version":"2","view":"grouped","data":[{"id":70141,"cve_ids":["CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 0.12.9 (LTS)","summary":"This security release fixes an HTTP pipelining denial-of-service issue and upgrades OpenSSL to 1.0.1q, which fixes CVE-2015-3194.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.9 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.9","evidence":"Node.js 0.12.9 (LTS)"}],"affected_versions":[]},{"name":{"value":"openssl","evidence":"openssl: Upgrade to 1.0.1q"},"prerequisites":[{"value":"Node.js TLS servers using client authentication; TLS clients are also impacted.","evidence":"a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted."}],"fixed_versions":[{"value":"1.0.1q","evidence":"openssl: Upgrade to 1.0.1q"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2015-3194","product":"openssl","evidence":"openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194"}],"related_cves":[{"value":"CVE-2015-3194","evidence":"fixes CVE-2015-3194"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.9","advisory_id":"0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","event_types":["patch"],"published_at":"2026-10-25T22:15:24.787398+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:02:00+00:00","detail_url":"/advisories/advisory%3A0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","group":{"id":"advisory:0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","revision":1,"primary_event_id":70511,"change":"published","superseded_by":[],"changed":{"id":70511,"cve_ids":["CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 0.12.9 (LTS)","summary":"This security release fixes an HTTP pipelining denial-of-service issue and upgrades OpenSSL to 1.0.1q, which fixes CVE-2015-3194.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.9 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.9","evidence":"Node.js 0.12.9 (LTS)"}],"affected_versions":[]},{"name":{"value":"openssl","evidence":"openssl: Upgrade to 1.0.1q"},"prerequisites":[{"value":"Node.js TLS servers using client authentication; TLS clients are also impacted.","evidence":"a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted."}],"fixed_versions":[{"value":"1.0.1q","evidence":"openssl: Upgrade to 1.0.1q"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2015-3194","product":"openssl","evidence":"openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194"}],"related_cves":[{"value":"CVE-2015-3194","evidence":"fixes CVE-2015-3194"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.9","advisory_id":"0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","event_types":["patch"],"published_at":"2026-10-25T22:15:24.787398+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:02:00+00:00","detail_url":"/events/70511"},"members":[{"id":70511,"cve_ids":["CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 0.12.9 (LTS)","summary":"This security release fixes an HTTP pipelining denial-of-service issue and upgrades OpenSSL to 1.0.1q, which fixes CVE-2015-3194.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.9 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.9","evidence":"Node.js 0.12.9 (LTS)"}],"affected_versions":[]},{"name":{"value":"openssl","evidence":"openssl: Upgrade to 1.0.1q"},"prerequisites":[{"value":"Node.js TLS servers using client authentication; TLS clients are also impacted.","evidence":"a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted."}],"fixed_versions":[{"value":"1.0.1q","evidence":"openssl: Upgrade to 1.0.1q"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2015-3194","product":"openssl","evidence":"openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194"}],"related_cves":[{"value":"CVE-2015-3194","evidence":"fixes CVE-2015-3194"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.9","advisory_id":"0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","event_types":["patch"],"published_at":"2026-10-25T22:15:24.787398+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:02:00+00:00","detail_url":"/events/70511"}]}},{"id":70107,"cve_ids":["CVE-2015-3193","CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 5.1.1 (Current)","summary":"Node.js 5.1.1 is described as an important security release. It upgrades OpenSSL to 1.0.2e and includes fixes for HTTP and V8 issues with potential denial-of-service or out-of-bounds-read impacts.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities. Notable changes(/ http: Fix a bug where an HTTP socket may no longer have an associated parser but a pipelined request triggers a pause or resume, a potential denial-of-service vector. (Fedor Indutny) openssl: Upgrade to 1.0.2e, containing fixes for: CVE-2015-3193 \"BN_mod_exp may produce incorrect results on x86_64\", an attack may be feasible against a Node.js TLS server using DHE key exchange. Details are available at http://openssl.org/news/secadv/20151203.txt. CVE-2015-3194 \"Certificate verify crash with missing PSS parameter\", a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted. Details are available at http://openssl.org/news/secadv/20151203.txt. (Shigeki Ohtsu) #4134 v8: Backport fixes for a bug in JSON.stringify() that can result in out-of-bounds reads for arrays. ","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.1.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.1.1","evidence":"Node.js 5.1.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-3193","evidence":"CVE-2015-3193 \"BN_mod_exp may produce incorrect results on x86_64\""},{"value":"CVE-2015-3194","evidence":"CVE-2015-3194 \"Certificate verify crash with missing PSS parameter\""}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f8a64011-4c66-49d2-9aaf-d2f465d178e3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.1.1","advisory_id":"f8a64011-4c66-49d2-9aaf-d2f465d178e3","event_types":["patch"],"published_at":"2026-10-25T22:14:23.323735+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:04:00+00:00","detail_url":"/advisories/advisory%3Af8a64011-4c66-49d2-9aaf-d2f465d178e3","group":{"id":"advisory:f8a64011-4c66-49d2-9aaf-d2f465d178e3","revision":1,"primary_event_id":70477,"change":"published","superseded_by":[],"changed":{"id":70477,"cve_ids":["CVE-2015-3193","CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 5.1.1 (Current)","summary":"Node.js 5.1.1 is described as an important security release. It upgrades OpenSSL to 1.0.2e and includes fixes for HTTP and V8 issues with potential denial-of-service or out-of-bounds-read impacts.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities. Notable changes(/ http: Fix a bug where an HTTP socket may no longer have an associated parser but a pipelined request triggers a pause or resume, a potential denial-of-service vector. (Fedor Indutny) openssl: Upgrade to 1.0.2e, containing fixes for: CVE-2015-3193 \"BN_mod_exp may produce incorrect results on x86_64\", an attack may be feasible against a Node.js TLS server using DHE key exchange. Details are available at http://openssl.org/news/secadv/20151203.txt. CVE-2015-3194 \"Certificate verify crash with missing PSS parameter\", a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted. Details are available at http://openssl.org/news/secadv/20151203.txt. (Shigeki Ohtsu) #4134 v8: Backport fixes for a bug in JSON.stringify() that can result in out-of-bounds reads for arrays. ","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.1.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.1.1","evidence":"Node.js 5.1.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-3193","evidence":"CVE-2015-3193 \"BN_mod_exp may produce incorrect results on x86_64\""},{"value":"CVE-2015-3194","evidence":"CVE-2015-3194 \"Certificate verify crash with missing PSS parameter\""}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f8a64011-4c66-49d2-9aaf-d2f465d178e3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.1.1","advisory_id":"f8a64011-4c66-49d2-9aaf-d2f465d178e3","event_types":["patch"],"published_at":"2026-10-25T22:14:23.323735+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:04:00+00:00","detail_url":"/events/70477"},"members":[{"id":70477,"cve_ids":["CVE-2015-3193","CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 5.1.1 (Current)","summary":"Node.js 5.1.1 is described as an important security release. It upgrades OpenSSL to 1.0.2e and includes fixes for HTTP and V8 issues with potential denial-of-service or out-of-bounds-read impacts.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities. Notable changes(/ http: Fix a bug where an HTTP socket may no longer have an associated parser but a pipelined request triggers a pause or resume, a potential denial-of-service vector. (Fedor Indutny) openssl: Upgrade to 1.0.2e, containing fixes for: CVE-2015-3193 \"BN_mod_exp may produce incorrect results on x86_64\", an attack may be feasible against a Node.js TLS server using DHE key exchange. Details are available at http://openssl.org/news/secadv/20151203.txt. CVE-2015-3194 \"Certificate verify crash with missing PSS parameter\", a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted. Details are available at http://openssl.org/news/secadv/20151203.txt. (Shigeki Ohtsu) #4134 v8: Backport fixes for a bug in JSON.stringify() that can result in out-of-bounds reads for arrays. ","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.1.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.1.1","evidence":"Node.js 5.1.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-3193","evidence":"CVE-2015-3193 \"BN_mod_exp may produce incorrect results on x86_64\""},{"value":"CVE-2015-3194","evidence":"CVE-2015-3194 \"Certificate verify crash with missing PSS parameter\""}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f8a64011-4c66-49d2-9aaf-d2f465d178e3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.1.1","advisory_id":"f8a64011-4c66-49d2-9aaf-d2f465d178e3","event_types":["patch"],"published_at":"2026-10-25T22:14:23.323735+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:04:00+00:00","detail_url":"/events/70477"}]}}],"next_after":70141,"next_before":70107}