{"schema_version":"2","view":"grouped","data":[{"id":58954,"cve_ids":["CVE-2017-1000381"],"payload":{"kind":"patch","title":"Node.js 8.1.4 (Current)","summary":"Node.js 8.1.4 disables V8 snapshots to address hash-seed collision risk and includes a c-ares patch for CVE-2017-1000381, which checks that NAPTR records contain required data before processing.","evidence":"Node.js 8.1.4 (Current) Notable changes build: Disable V8 snapshots - The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found (Ali Ijaz Sheikh) deps: CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.1.4 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"8.1.4","evidence":"Node.js 8.1.4 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2017-1000381","product":"Node.js","evidence":"Node.js 8.1.4 (Current) Notable changes build: Disable V8 snapshots - The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found (Ali Ijaz Sheikh) deps: CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record."}],"related_cves":[{"value":"CVE-2017-1000381","evidence":"deps: CVE-2017-1000381"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1d9f8e83-2b10-4227-82c8-c534691df429","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.1.4","advisory_id":"1d9f8e83-2b10-4227-82c8-c534691df429","event_types":["patch"],"published_at":"2026-10-25T17:42:24.926819+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:01:31+00:00","detail_url":"/advisories/advisory%3A1d9f8e83-2b10-4227-82c8-c534691df429","group":{"id":"advisory:1d9f8e83-2b10-4227-82c8-c534691df429","revision":1,"primary_event_id":58185,"change":"published","superseded_by":[],"changed":{"id":58185,"cve_ids":["CVE-2017-1000381"],"payload":{"kind":"patch","title":"Node.js 8.1.4 (Current)","summary":"Node.js 8.1.4 disables V8 snapshots to address hash-seed collision risk and includes a c-ares patch for CVE-2017-1000381, which checks that NAPTR records contain required data before processing.","evidence":"Node.js 8.1.4 (Current) Notable changes build: Disable V8 snapshots - The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found (Ali Ijaz Sheikh) deps: CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.1.4 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"8.1.4","evidence":"Node.js 8.1.4 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2017-1000381","product":"Node.js","evidence":"Node.js 8.1.4 (Current) Notable changes build: Disable V8 snapshots - The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found (Ali Ijaz Sheikh) deps: CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record."}],"related_cves":[{"value":"CVE-2017-1000381","evidence":"deps: CVE-2017-1000381"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1d9f8e83-2b10-4227-82c8-c534691df429","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.1.4","advisory_id":"1d9f8e83-2b10-4227-82c8-c534691df429","event_types":["patch"],"published_at":"2026-10-25T17:42:24.926819+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:01:31+00:00","detail_url":"/events/58185"},"members":[{"id":58185,"cve_ids":["CVE-2017-1000381"],"payload":{"kind":"patch","title":"Node.js 8.1.4 (Current)","summary":"Node.js 8.1.4 disables V8 snapshots to address hash-seed collision risk and includes a c-ares patch for CVE-2017-1000381, which checks that NAPTR records contain required data before processing.","evidence":"Node.js 8.1.4 (Current) Notable changes build: Disable V8 snapshots - The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found (Ali Ijaz Sheikh) deps: CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.1.4 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"8.1.4","evidence":"Node.js 8.1.4 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2017-1000381","product":"Node.js","evidence":"Node.js 8.1.4 (Current) Notable changes build: Disable V8 snapshots - The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found (Ali Ijaz Sheikh) deps: CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record."}],"related_cves":[{"value":"CVE-2017-1000381","evidence":"deps: CVE-2017-1000381"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1d9f8e83-2b10-4227-82c8-c534691df429","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.1.4","advisory_id":"1d9f8e83-2b10-4227-82c8-c534691df429","event_types":["patch"],"published_at":"2026-10-25T17:42:24.926819+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:01:31+00:00","detail_url":"/events/58185"}]}},{"id":58878,"cve_ids":["CVE-2017-1000381","CVE-2017-11499"],"payload":{"kind":"patch","title":"Security updates for all active release lines, July 2017","summary":"Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.","evidence":"Updates are now available for all active Node.js release lines as well as the 7.x line.","products":[{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[],"fixed_versions":[{"value":"8.3.0","evidence":"The vulnerability has been patched upstream and snapshots have been re-enabled in 8.3.0"}],"affected_versions":[{"value":"4.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"6.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"7.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"8.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"0.10.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."},{"value":"0.12.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."}]},{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[{"value":"the auth field of the options object used with http.get() to be set to a number","evidence":"Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string."}],"fixed_versions":[],"affected_versions":[{"value":"4.x","evidence":"This is a low severity defect and only applies to the 4.x release line."}]},{"name":{"value":"c-ares","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"all versions of Node.js","evidence":"A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js."}]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2017-11499","evidence":"Constant Hashtable Seeds (CVE-2017-11499)"},{"value":"CVE-2017-1000381","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"}],"security_relevant":true,"severity_evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},"group_id":"advisory:d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2017-security-releases","advisory_id":"d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","event_types":["patch"],"published_at":"2026-10-25T17:37:33.873005+00:00","technologies":["c-ares","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:00:00+00:00","detail_url":"/advisories/advisory%3Ad5d16605-1fc0-4ee5-8f91-90b7c9e84b49","group":{"id":"advisory:d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","revision":1,"primary_event_id":58109,"change":"published","superseded_by":[],"changed":{"id":58109,"cve_ids":["CVE-2017-1000381","CVE-2017-11499"],"payload":{"kind":"patch","title":"Security updates for all active release lines, July 2017","summary":"Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.","evidence":"Updates are now available for all active Node.js release lines as well as the 7.x line.","products":[{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[],"fixed_versions":[{"value":"8.3.0","evidence":"The vulnerability has been patched upstream and snapshots have been re-enabled in 8.3.0"}],"affected_versions":[{"value":"4.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"6.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"7.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"8.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"0.10.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."},{"value":"0.12.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."}]},{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[{"value":"the auth field of the options object used with http.get() to be set to a number","evidence":"Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string."}],"fixed_versions":[],"affected_versions":[{"value":"4.x","evidence":"This is a low severity defect and only applies to the 4.x release line."}]},{"name":{"value":"c-ares","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"all versions of Node.js","evidence":"A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js."}]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2017-11499","evidence":"Constant Hashtable Seeds (CVE-2017-11499)"},{"value":"CVE-2017-1000381","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"}],"security_relevant":true,"severity_evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},"group_id":"advisory:d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2017-security-releases","advisory_id":"d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","event_types":["patch"],"published_at":"2026-10-25T17:37:33.873005+00:00","technologies":["c-ares","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:00:00+00:00","detail_url":"/events/58109"},"members":[{"id":58109,"cve_ids":["CVE-2017-1000381","CVE-2017-11499"],"payload":{"kind":"patch","title":"Security updates for all active release lines, July 2017","summary":"Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.","evidence":"Updates are now available for all active Node.js release lines as well as the 7.x line.","products":[{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[],"fixed_versions":[{"value":"8.3.0","evidence":"The vulnerability has been patched upstream and snapshots have been re-enabled in 8.3.0"}],"affected_versions":[{"value":"4.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"6.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"7.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"8.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"0.10.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."},{"value":"0.12.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."}]},{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[{"value":"the auth field of the options object used with http.get() to be set to a number","evidence":"Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string."}],"fixed_versions":[],"affected_versions":[{"value":"4.x","evidence":"This is a low severity defect and only applies to the 4.x release line."}]},{"name":{"value":"c-ares","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"all versions of Node.js","evidence":"A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js."}]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2017-11499","evidence":"Constant Hashtable Seeds (CVE-2017-11499)"},{"value":"CVE-2017-1000381","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"}],"security_relevant":true,"severity_evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},"group_id":"advisory:d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2017-security-releases","advisory_id":"d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","event_types":["patch"],"published_at":"2026-10-25T17:37:33.873005+00:00","technologies":["c-ares","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:00:00+00:00","detail_url":"/events/58109"}]}}],"next_after":58954,"next_before":58878}