{"schema_version":"2","view":"grouped","data":[{"id":69319,"cve_ids":["CVE-2015-3197","CVE-2016-0701"],"payload":{"kind":"advisory","title":"OpenSSL upgrade low-severity Node.js security fixes","summary":"Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.","evidence":"The Node.js project will be releasing new versions across all of its active release lines early next week (possibly sooner, pending full impact assessment) to incorporate upstream patches from OpenSSL and some additional low-severity fixes relating to HTTP handling.","products":[{"name":{"value":"Node.js","evidence":"Versions 0.10.x of Node.js are affected."},"prerequisites":[{"value":"unless the --enable-ssl2 command line argument is being used (not recommended).","evidence":"Node.js v0.10 and v0.12 disable SSLv2 by default and are not affected unless the --enable-ssl2 command line argument is being used (not recommended)."}],"fixed_versions":[],"affected_versions":[{"value":"0.10.x","evidence":"Versions 0.10.x of Node.js are affected."},{"value":"0.12.x","evidence":"Versions 0.12.x of Node.js are affected."},{"value":"4.x","evidence":"Versions 4.x, including LTS Argon, of Node.js are affected."},{"value":"5.x","evidence":"Versions 5.x of Node.js are affected."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0701","evidence":"DH small subgroups (CVE-2016-0701)"},{"value":"CVE-2015-3197","evidence":"SSLv2 doesn't block disabled ciphers (CVE-2015-3197)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d6fcf49e-5589-4505-a24a-e46bca0d35c9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-and-low-severity-fixes-jan-2016","advisory_id":"d6fcf49e-5589-4505-a24a-e46bca0d35c9","event_types":["advisory"],"published_at":"2026-10-25T21:56:26.373403+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-01-27T11:34:41+00:00","detail_url":"/advisories/advisory%3Ad6fcf49e-5589-4505-a24a-e46bca0d35c9","group":{"id":"advisory:d6fcf49e-5589-4505-a24a-e46bca0d35c9","revision":1,"primary_event_id":69689,"change":"published","superseded_by":[],"changed":{"id":69689,"cve_ids":["CVE-2015-3197","CVE-2016-0701"],"payload":{"kind":"advisory","title":"OpenSSL upgrade low-severity Node.js security fixes","summary":"Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.","evidence":"The Node.js project will be releasing new versions across all of its active release lines early next week (possibly sooner, pending full impact assessment) to incorporate upstream patches from OpenSSL and some additional low-severity fixes relating to HTTP handling.","products":[{"name":{"value":"Node.js","evidence":"Versions 0.10.x of Node.js are affected."},"prerequisites":[{"value":"unless the --enable-ssl2 command line argument is being used (not recommended).","evidence":"Node.js v0.10 and v0.12 disable SSLv2 by default and are not affected unless the --enable-ssl2 command line argument is being used (not recommended)."}],"fixed_versions":[],"affected_versions":[{"value":"0.10.x","evidence":"Versions 0.10.x of Node.js are affected."},{"value":"0.12.x","evidence":"Versions 0.12.x of Node.js are affected."},{"value":"4.x","evidence":"Versions 4.x, including LTS Argon, of Node.js are affected."},{"value":"5.x","evidence":"Versions 5.x of Node.js are affected."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0701","evidence":"DH small subgroups (CVE-2016-0701)"},{"value":"CVE-2015-3197","evidence":"SSLv2 doesn't block disabled ciphers (CVE-2015-3197)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d6fcf49e-5589-4505-a24a-e46bca0d35c9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-and-low-severity-fixes-jan-2016","advisory_id":"d6fcf49e-5589-4505-a24a-e46bca0d35c9","event_types":["advisory"],"published_at":"2026-10-25T21:56:26.373403+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-01-27T11:34:41+00:00","detail_url":"/events/69689"},"members":[{"id":69689,"cve_ids":["CVE-2015-3197","CVE-2016-0701"],"payload":{"kind":"advisory","title":"OpenSSL upgrade low-severity Node.js security fixes","summary":"Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.","evidence":"The Node.js project will be releasing new versions across all of its active release lines early next week (possibly sooner, pending full impact assessment) to incorporate upstream patches from OpenSSL and some additional low-severity fixes relating to HTTP handling.","products":[{"name":{"value":"Node.js","evidence":"Versions 0.10.x of Node.js are affected."},"prerequisites":[{"value":"unless the --enable-ssl2 command line argument is being used (not recommended).","evidence":"Node.js v0.10 and v0.12 disable SSLv2 by default and are not affected unless the --enable-ssl2 command line argument is being used (not recommended)."}],"fixed_versions":[],"affected_versions":[{"value":"0.10.x","evidence":"Versions 0.10.x of Node.js are affected."},{"value":"0.12.x","evidence":"Versions 0.12.x of Node.js are affected."},{"value":"4.x","evidence":"Versions 4.x, including LTS Argon, of Node.js are affected."},{"value":"5.x","evidence":"Versions 5.x of Node.js are affected."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0701","evidence":"DH small subgroups (CVE-2016-0701)"},{"value":"CVE-2015-3197","evidence":"SSLv2 doesn't block disabled ciphers (CVE-2015-3197)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d6fcf49e-5589-4505-a24a-e46bca0d35c9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-and-low-severity-fixes-jan-2016","advisory_id":"d6fcf49e-5589-4505-a24a-e46bca0d35c9","event_types":["advisory"],"published_at":"2026-10-25T21:56:26.373403+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-01-27T11:34:41+00:00","detail_url":"/events/69689"}]}}],"next_after":69319,"next_before":69319}