{"schema_version":"2","view":"grouped","data":[{"id":63465,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6303","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 4.6.0 (LTS)","summary":"Node.js 4.6.0 (LTS) is an important security release that updates OpenSSL and patches HTTP and TLS vulnerabilities, among other security changes.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.6.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.6.0","evidence":"Node.js 4.6.0 (LTS)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-6303","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead()."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#46 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#65 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check"}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183"},{"value":"CVE-2016-6303","evidence":"CVE-2016-6303"},{"value":"CVE-2016-2178","evidence":"CVE-2016-2178"},{"value":"CVE-2016-6306","evidence":"CVE-2016-6306"},{"value":"CVE-2016-7052","evidence":"CVE-2016-7052"},{"value":"CVE-2016-5325","evidence":"CVE-2016-5325"},{"value":"CVE-2016-7099","evidence":"CVE-2016-7099"}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:5402985e-9a11-4aea-a529-3b81fbeb7d78","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.6.0","advisory_id":"5402985e-9a11-4aea-a529-3b81fbeb7d78","event_types":["patch"],"published_at":"2026-10-25T19:32:33.194831+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:47:06+00:00","detail_url":"/advisories/advisory%3A5402985e-9a11-4aea-a529-3b81fbeb7d78","group":{"id":"advisory:5402985e-9a11-4aea-a529-3b81fbeb7d78","revision":1,"primary_event_id":62746,"change":"published","superseded_by":[],"changed":{"id":62746,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6303","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 4.6.0 (LTS)","summary":"Node.js 4.6.0 (LTS) is an important security release that updates OpenSSL and patches HTTP and TLS vulnerabilities, among other security changes.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.6.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.6.0","evidence":"Node.js 4.6.0 (LTS)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-6303","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead()."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#46 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#65 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check"}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183"},{"value":"CVE-2016-6303","evidence":"CVE-2016-6303"},{"value":"CVE-2016-2178","evidence":"CVE-2016-2178"},{"value":"CVE-2016-6306","evidence":"CVE-2016-6306"},{"value":"CVE-2016-7052","evidence":"CVE-2016-7052"},{"value":"CVE-2016-5325","evidence":"CVE-2016-5325"},{"value":"CVE-2016-7099","evidence":"CVE-2016-7099"}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:5402985e-9a11-4aea-a529-3b81fbeb7d78","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.6.0","advisory_id":"5402985e-9a11-4aea-a529-3b81fbeb7d78","event_types":["patch"],"published_at":"2026-10-25T19:32:33.194831+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:47:06+00:00","detail_url":"/events/62746"},"members":[{"id":62746,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6303","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 4.6.0 (LTS)","summary":"Node.js 4.6.0 (LTS) is an important security release that updates OpenSSL and patches HTTP and TLS vulnerabilities, among other security changes.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.6.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.6.0","evidence":"Node.js 4.6.0 (LTS)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-6303","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead()."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#46 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#65 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check"}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183"},{"value":"CVE-2016-6303","evidence":"CVE-2016-6303"},{"value":"CVE-2016-2178","evidence":"CVE-2016-2178"},{"value":"CVE-2016-6306","evidence":"CVE-2016-6306"},{"value":"CVE-2016-7052","evidence":"CVE-2016-7052"},{"value":"CVE-2016-5325","evidence":"CVE-2016-5325"},{"value":"CVE-2016-7099","evidence":"CVE-2016-7099"}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:5402985e-9a11-4aea-a529-3b81fbeb7d78","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.6.0","advisory_id":"5402985e-9a11-4aea-a529-3b81fbeb7d78","event_types":["patch"],"published_at":"2026-10-25T19:32:33.194831+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:47:06+00:00","detail_url":"/events/62746"}]}},{"id":63061,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 6.7.0 (Current)","summary":"Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.","evidence":"Node.js 6.7.0 (Current) This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.7.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.7.0","evidence":"Node.js 6.7.0 (Current)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#60 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#64 src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) #8572 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-2178","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-6306","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-7052","evidence":"Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"value":"CVE-2016-5325","evidence":"http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"value":"CVE-2016-7099","evidence":"tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:716b05fd-10c0-4a7b-b4b8-c2e86940f80b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.7.0","advisory_id":"716b05fd-10c0-4a7b-b4b8-c2e86940f80b","event_types":["patch"],"published_at":"2026-10-25T19:16:39.667156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:49:35+00:00","detail_url":"/advisories/advisory%3A716b05fd-10c0-4a7b-b4b8-c2e86940f80b","group":{"id":"advisory:716b05fd-10c0-4a7b-b4b8-c2e86940f80b","revision":1,"primary_event_id":62294,"change":"published","superseded_by":[],"changed":{"id":62294,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 6.7.0 (Current)","summary":"Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.","evidence":"Node.js 6.7.0 (Current) This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.7.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.7.0","evidence":"Node.js 6.7.0 (Current)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#60 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#64 src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) #8572 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-2178","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-6306","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-7052","evidence":"Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"value":"CVE-2016-5325","evidence":"http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"value":"CVE-2016-7099","evidence":"tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:716b05fd-10c0-4a7b-b4b8-c2e86940f80b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.7.0","advisory_id":"716b05fd-10c0-4a7b-b4b8-c2e86940f80b","event_types":["patch"],"published_at":"2026-10-25T19:16:39.667156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:49:35+00:00","detail_url":"/events/62294"},"members":[{"id":62294,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 6.7.0 (Current)","summary":"Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.","evidence":"Node.js 6.7.0 (Current) This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.7.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.7.0","evidence":"Node.js 6.7.0 (Current)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#60 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#64 src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) #8572 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-2178","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-6306","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-7052","evidence":"Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"value":"CVE-2016-5325","evidence":"http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"value":"CVE-2016-7099","evidence":"tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:716b05fd-10c0-4a7b-b4b8-c2e86940f80b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.7.0","advisory_id":"716b05fd-10c0-4a7b-b4b8-c2e86940f80b","event_types":["patch"],"published_at":"2026-10-25T19:16:39.667156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:49:35+00:00","detail_url":"/events/62294"}]}}],"next_after":63465,"next_before":63061}