{"schema_version":"2","view":"grouped","data":[{"id":71259,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"CVE-2015-8027 Denial of Service Vulnerability / CVE-2015-6764 V8 Out-of-bounds Access Vulnerability","summary":"The announcement describes a denial-of-service vulnerability affecting Node.js v0.12.x through v5.x and a V8 out-of-bounds access vulnerability affecting v4.x and v5.x when user-supplied JavaScript can be executed. It says fixes will be included in upcoming releases; no fixed versions are specified.","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service.","products":[{"name":{"value":"Node.js","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service."},"prerequisites":[{"value":"if user-supplied JavaScript can be executed by an application","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application."}],"fixed_versions":[],"affected_versions":[{"value":"v0.12.x through to v5.x inclusive","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service."},{"value":"all versions of v4.x and v5.x","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"CVE-2015-8027: a high-impact denial of service vulnerability"},{"value":"CVE-2015-6764","evidence":"CVE-2015-6764: a low-impact V8 out-of-bounds access vulnerability"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b4909c8b-83d1-4bcc-83bf-cb2d4cf1aca0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764","advisory_id":"b4909c8b-83d1-4bcc-83bf-cb2d4cf1aca0","event_types":["advisory"],"published_at":"2026-10-25T22:59:23.960441+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-11-25T22:06:05+00:00","detail_url":"/advisories/advisory%3Ab4909c8b-83d1-4bcc-83bf-cb2d4cf1aca0","group":{"id":"advisory:b4909c8b-83d1-4bcc-83bf-cb2d4cf1aca0","revision":1,"primary_event_id":71644,"change":"published","superseded_by":[],"changed":{"id":71644,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"CVE-2015-8027 Denial of Service Vulnerability / CVE-2015-6764 V8 Out-of-bounds Access Vulnerability","summary":"The announcement describes a denial-of-service vulnerability affecting Node.js v0.12.x through v5.x and a V8 out-of-bounds access vulnerability affecting v4.x and v5.x when user-supplied JavaScript can be executed. It says fixes will be included in upcoming releases; no fixed versions are specified.","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service.","products":[{"name":{"value":"Node.js","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service."},"prerequisites":[{"value":"if user-supplied JavaScript can be executed by an application","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application."}],"fixed_versions":[],"affected_versions":[{"value":"v0.12.x through to v5.x inclusive","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service."},{"value":"all versions of v4.x and v5.x","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"CVE-2015-8027: a high-impact denial of service vulnerability"},{"value":"CVE-2015-6764","evidence":"CVE-2015-6764: a low-impact V8 out-of-bounds access vulnerability"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b4909c8b-83d1-4bcc-83bf-cb2d4cf1aca0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764","advisory_id":"b4909c8b-83d1-4bcc-83bf-cb2d4cf1aca0","event_types":["advisory"],"published_at":"2026-10-25T22:59:23.960441+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-11-25T22:06:05+00:00","detail_url":"/events/71644"},"members":[{"id":71644,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"CVE-2015-8027 Denial of Service Vulnerability / CVE-2015-6764 V8 Out-of-bounds Access Vulnerability","summary":"The announcement describes a denial-of-service vulnerability affecting Node.js v0.12.x through v5.x and a V8 out-of-bounds access vulnerability affecting v4.x and v5.x when user-supplied JavaScript can be executed. It says fixes will be included in upcoming releases; no fixed versions are specified.","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service.","products":[{"name":{"value":"Node.js","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service."},"prerequisites":[{"value":"if user-supplied JavaScript can be executed by an application","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application."}],"fixed_versions":[],"affected_versions":[{"value":"v0.12.x through to v5.x inclusive","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service."},{"value":"all versions of v4.x and v5.x","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"CVE-2015-8027: a high-impact denial of service vulnerability"},{"value":"CVE-2015-6764","evidence":"CVE-2015-6764: a low-impact V8 out-of-bounds access vulnerability"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b4909c8b-83d1-4bcc-83bf-cb2d4cf1aca0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764","advisory_id":"b4909c8b-83d1-4bcc-83bf-cb2d4cf1aca0","event_types":["advisory"],"published_at":"2026-10-25T22:59:23.960441+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-11-25T22:06:05+00:00","detail_url":"/events/71644"}]}},{"id":70430,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"Node.js security release planned for December 1 or 2, 2015","summary":"The announcement says upcoming Node.js releases will include fixes for CVE-2015-8027 across v0.12.x, v4.x, and v5.x, and for CVE-2015-6764 in v4.x and v5.x. It does not specify fixed versions.","evidence":"New releases of v0.12.x, v4.x and v5.x will be made available with appropriate fixes for CVE-2015-8027 and CVE-2015-6764 (for v4.x and v5.x only)","products":[{"name":{"value":"Node.js","evidence":"Node.js News — November 27th"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"appropriate fixes for CVE-2015-8027"},{"value":"CVE-2015-6764","evidence":"appropriate fixes for CVE-2015-8027 and CVE-2015-6764 (for v4.x and v5.x only)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c2ce8239-0069-476d-b761-30d4879c7075","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2015-11-27","advisory_id":"c2ce8239-0069-476d-b761-30d4879c7075","event_types":["advisory"],"published_at":"2026-10-25T22:24:22.821238+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-11-27T12:00:00+00:00","detail_url":"/advisories/advisory%3Ac2ce8239-0069-476d-b761-30d4879c7075","group":{"id":"advisory:c2ce8239-0069-476d-b761-30d4879c7075","revision":1,"primary_event_id":70800,"change":"published","superseded_by":[],"changed":{"id":70800,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"Node.js security release planned for December 1 or 2, 2015","summary":"The announcement says upcoming Node.js releases will include fixes for CVE-2015-8027 across v0.12.x, v4.x, and v5.x, and for CVE-2015-6764 in v4.x and v5.x. It does not specify fixed versions.","evidence":"New releases of v0.12.x, v4.x and v5.x will be made available with appropriate fixes for CVE-2015-8027 and CVE-2015-6764 (for v4.x and v5.x only)","products":[{"name":{"value":"Node.js","evidence":"Node.js News — November 27th"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"appropriate fixes for CVE-2015-8027"},{"value":"CVE-2015-6764","evidence":"appropriate fixes for CVE-2015-8027 and CVE-2015-6764 (for v4.x and v5.x only)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c2ce8239-0069-476d-b761-30d4879c7075","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2015-11-27","advisory_id":"c2ce8239-0069-476d-b761-30d4879c7075","event_types":["advisory"],"published_at":"2026-10-25T22:24:22.821238+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-11-27T12:00:00+00:00","detail_url":"/events/70800"},"members":[{"id":70800,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"Node.js security release planned for December 1 or 2, 2015","summary":"The announcement says upcoming Node.js releases will include fixes for CVE-2015-8027 across v0.12.x, v4.x, and v5.x, and for CVE-2015-6764 in v4.x and v5.x. It does not specify fixed versions.","evidence":"New releases of v0.12.x, v4.x and v5.x will be made available with appropriate fixes for CVE-2015-8027 and CVE-2015-6764 (for v4.x and v5.x only)","products":[{"name":{"value":"Node.js","evidence":"Node.js News — November 27th"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"appropriate fixes for CVE-2015-8027"},{"value":"CVE-2015-6764","evidence":"appropriate fixes for CVE-2015-8027 and CVE-2015-6764 (for v4.x and v5.x only)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c2ce8239-0069-476d-b761-30d4879c7075","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2015-11-27","advisory_id":"c2ce8239-0069-476d-b761-30d4879c7075","event_types":["advisory"],"published_at":"2026-10-25T22:24:22.821238+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-11-27T12:00:00+00:00","detail_url":"/events/70800"}]}},{"id":70335,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"December Security Release Schedule Update","summary":"Node.js postponed its planned security releases to include upstream OpenSSL fixes and announced vulnerabilities affecting several Node.js release lines. Fixes were planned for v4.x and v5.x for CVE-2015-6764, alongside CVE-2015-8027; the announcement gives no released fixed versions.","evidence":"we have decided to postpone our security releases to coincide with OpenSSL release availability","products":[{"name":{"value":"Node.js","evidence":"Node.js versions v0.10.x and v0.12.x depend on OpenSSL v1.0.1"},"prerequisites":[{"value":"if user-supplied JavaScript can be executed by an application","evidence":"if user-supplied JavaScript can be executed by an application"}],"fixed_versions":[],"affected_versions":[{"value":"all versions of v0.12.x through to v5.x inclusive","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive"},{"value":"all versions of v4.x and v5.x","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x"},{"value":"Versions 0.10.x","evidence":"Versions 0.10.x of Node.js may be vulnerable."},{"value":"Versions 0.12.x","evidence":"Versions 0.12.x of Node.js may be vulnerable."},{"value":"Versions 4.x, including LTS Argon","evidence":"Versions 4.x, including LTS Argon, of Node.js may be vulnerable."},{"value":"Versions 5.x","evidence":"Versions 5.x of Node.js may be vulnerable."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"CVE-2015-8027 Denial of Service Vulnerability"},{"value":"CVE-2015-6764","evidence":"CVE-2015-6764 V8 Out-of-bounds Access Vulnerability"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:79f8a6ec-8077-4606-9099-dc1bc4f7f71c","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2015-security-release-update","advisory_id":"79f8a6ec-8077-4606-9099-dc1bc4f7f71c","event_types":["advisory"],"published_at":"2026-10-25T22:21:24.223028+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-01T01:13:57+00:00","detail_url":"/advisories/advisory%3A79f8a6ec-8077-4606-9099-dc1bc4f7f71c","group":{"id":"advisory:79f8a6ec-8077-4606-9099-dc1bc4f7f71c","revision":1,"primary_event_id":70705,"change":"published","superseded_by":[],"changed":{"id":70705,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"December Security Release Schedule Update","summary":"Node.js postponed its planned security releases to include upstream OpenSSL fixes and announced vulnerabilities affecting several Node.js release lines. Fixes were planned for v4.x and v5.x for CVE-2015-6764, alongside CVE-2015-8027; the announcement gives no released fixed versions.","evidence":"we have decided to postpone our security releases to coincide with OpenSSL release availability","products":[{"name":{"value":"Node.js","evidence":"Node.js versions v0.10.x and v0.12.x depend on OpenSSL v1.0.1"},"prerequisites":[{"value":"if user-supplied JavaScript can be executed by an application","evidence":"if user-supplied JavaScript can be executed by an application"}],"fixed_versions":[],"affected_versions":[{"value":"all versions of v0.12.x through to v5.x inclusive","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive"},{"value":"all versions of v4.x and v5.x","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x"},{"value":"Versions 0.10.x","evidence":"Versions 0.10.x of Node.js may be vulnerable."},{"value":"Versions 0.12.x","evidence":"Versions 0.12.x of Node.js may be vulnerable."},{"value":"Versions 4.x, including LTS Argon","evidence":"Versions 4.x, including LTS Argon, of Node.js may be vulnerable."},{"value":"Versions 5.x","evidence":"Versions 5.x of Node.js may be vulnerable."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"CVE-2015-8027 Denial of Service Vulnerability"},{"value":"CVE-2015-6764","evidence":"CVE-2015-6764 V8 Out-of-bounds Access Vulnerability"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:79f8a6ec-8077-4606-9099-dc1bc4f7f71c","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2015-security-release-update","advisory_id":"79f8a6ec-8077-4606-9099-dc1bc4f7f71c","event_types":["advisory"],"published_at":"2026-10-25T22:21:24.223028+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-01T01:13:57+00:00","detail_url":"/events/70705"},"members":[{"id":70705,"cve_ids":["CVE-2015-6764","CVE-2015-8027"],"payload":{"kind":"advisory","title":"December Security Release Schedule Update","summary":"Node.js postponed its planned security releases to include upstream OpenSSL fixes and announced vulnerabilities affecting several Node.js release lines. Fixes were planned for v4.x and v5.x for CVE-2015-6764, alongside CVE-2015-8027; the announcement gives no released fixed versions.","evidence":"we have decided to postpone our security releases to coincide with OpenSSL release availability","products":[{"name":{"value":"Node.js","evidence":"Node.js versions v0.10.x and v0.12.x depend on OpenSSL v1.0.1"},"prerequisites":[{"value":"if user-supplied JavaScript can be executed by an application","evidence":"if user-supplied JavaScript can be executed by an application"}],"fixed_versions":[],"affected_versions":[{"value":"all versions of v0.12.x through to v5.x inclusive","evidence":"A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive"},{"value":"all versions of v4.x and v5.x","evidence":"An additional bug exists in Node.js, all versions of v4.x and v5.x"},{"value":"Versions 0.10.x","evidence":"Versions 0.10.x of Node.js may be vulnerable."},{"value":"Versions 0.12.x","evidence":"Versions 0.12.x of Node.js may be vulnerable."},{"value":"Versions 4.x, including LTS Argon","evidence":"Versions 4.x, including LTS Argon, of Node.js may be vulnerable."},{"value":"Versions 5.x","evidence":"Versions 5.x of Node.js may be vulnerable."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2015-8027","evidence":"CVE-2015-8027 Denial of Service Vulnerability"},{"value":"CVE-2015-6764","evidence":"CVE-2015-6764 V8 Out-of-bounds Access Vulnerability"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:79f8a6ec-8077-4606-9099-dc1bc4f7f71c","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2015-security-release-update","advisory_id":"79f8a6ec-8077-4606-9099-dc1bc4f7f71c","event_types":["advisory"],"published_at":"2026-10-25T22:21:24.223028+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-01T01:13:57+00:00","detail_url":"/events/70705"}]}}],"next_after":71259,"next_before":70335}