{"schema_version":"2","view":"grouped","data":[{"id":52398,"cve_ids":["CVE-2018-0734","CVE-2018-0735","CVE-2018-12116","CVE-2018-12120","CVE-2018-12121","CVE-2018-12122","CVE-2018-12123","CVE-2018-5407"],"payload":{"kind":"patch","title":"November 2018 Security Releases","summary":"Node.js security releases address multiple vulnerabilities across active release lines. Upgrade to the listed release versions; OpenSSL dependencies are also updated in Node.js 6, 8, 10 and 11.","evidence":"Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement (below).","products":[{"name":{"value":"Node.js 11","evidence":"Node.js 11.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.3.0","evidence":"Node.js 11.3.0 (Current)"}],"affected_versions":[{"value":"All versions of Node.js 11","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"Node.js 10","evidence":"Node.js 10.14.0 (LTS \"Dubnium\")"},"prerequisites":[],"fixed_versions":[{"value":"10.14.0","evidence":"Node.js 10.14.0 (LTS \"Dubnium\")"}],"affected_versions":[{"value":"All versions of Node.js 10","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"}]},{"name":{"value":"Node.js 8","evidence":"Node.js 8.14.0 (LTS \"Carbon\")"},"prerequisites":[],"fixed_versions":[{"value":"8.14.0","evidence":"Node.js 8.14.0 (LTS \"Carbon\")"}],"affected_versions":[{"value":"All versions of Node.js 8","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"}]},{"name":{"value":"Node.js 6","evidence":"Node.js 6.15.0 (LTS \"Boron\")"},"prerequisites":[],"fixed_versions":[{"value":"6.15.0","evidence":"Node.js 6.15.0 (LTS \"Boron\")"},{"value":"6.15.1","evidence":"Node.js 6.15.1 (LTS \"Boron\") was released to fix a misapplied backport"}],"affected_versions":[{"value":"All versions of Node.js 6","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-12120","evidence":"Debugger port 5858 listens on any interface by default (CVE-2018-12120)"},{"value":"CVE-2018-12121","evidence":"Denial of Service with large HTTP headers (CVE-2018-12121)"},{"value":"CVE-2018-12122","evidence":"\"Slowloris\" HTTP Denial of Service (CVE-2018-12122)"},{"value":"CVE-2018-12123","evidence":"Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)"},{"value":"CVE-2018-12116","evidence":"HTTP request splitting (CVE-2018-12116)"},{"value":"CVE-2018-0735","evidence":"OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)"},{"value":"CVE-2018-0734","evidence":"OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)"},{"value":"CVE-2018-5407","evidence":"OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:548fc980-6840-4bc0-bafd-a890ea2cfce9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases","advisory_id":"548fc980-6840-4bc0-bafd-a890ea2cfce9","event_types":["patch"],"published_at":"2026-10-25T14:34:29.804197+00:00","technologies":["node-js-10","node-js-11","node-js-6","node-js-8","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2018-11-28T00:55:46+00:00","detail_url":"/advisories/advisory%3A548fc980-6840-4bc0-bafd-a890ea2cfce9","group":{"id":"advisory:548fc980-6840-4bc0-bafd-a890ea2cfce9","revision":1,"primary_event_id":51926,"change":"published","superseded_by":[],"changed":{"id":51926,"cve_ids":["CVE-2018-0734","CVE-2018-0735","CVE-2018-12116","CVE-2018-12120","CVE-2018-12121","CVE-2018-12122","CVE-2018-12123","CVE-2018-5407"],"payload":{"kind":"patch","title":"November 2018 Security Releases","summary":"Node.js security releases address multiple vulnerabilities across active release lines. Upgrade to the listed release versions; OpenSSL dependencies are also updated in Node.js 6, 8, 10 and 11.","evidence":"Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement (below).","products":[{"name":{"value":"Node.js 11","evidence":"Node.js 11.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.3.0","evidence":"Node.js 11.3.0 (Current)"}],"affected_versions":[{"value":"All versions of Node.js 11","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"Node.js 10","evidence":"Node.js 10.14.0 (LTS \"Dubnium\")"},"prerequisites":[],"fixed_versions":[{"value":"10.14.0","evidence":"Node.js 10.14.0 (LTS \"Dubnium\")"}],"affected_versions":[{"value":"All versions of Node.js 10","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"}]},{"name":{"value":"Node.js 8","evidence":"Node.js 8.14.0 (LTS \"Carbon\")"},"prerequisites":[],"fixed_versions":[{"value":"8.14.0","evidence":"Node.js 8.14.0 (LTS \"Carbon\")"}],"affected_versions":[{"value":"All versions of Node.js 8","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"}]},{"name":{"value":"Node.js 6","evidence":"Node.js 6.15.0 (LTS \"Boron\")"},"prerequisites":[],"fixed_versions":[{"value":"6.15.0","evidence":"Node.js 6.15.0 (LTS \"Boron\")"},{"value":"6.15.1","evidence":"Node.js 6.15.1 (LTS \"Boron\") was released to fix a misapplied backport"}],"affected_versions":[{"value":"All versions of Node.js 6","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-12120","evidence":"Debugger port 5858 listens on any interface by default (CVE-2018-12120)"},{"value":"CVE-2018-12121","evidence":"Denial of Service with large HTTP headers (CVE-2018-12121)"},{"value":"CVE-2018-12122","evidence":"\"Slowloris\" HTTP Denial of Service (CVE-2018-12122)"},{"value":"CVE-2018-12123","evidence":"Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)"},{"value":"CVE-2018-12116","evidence":"HTTP request splitting (CVE-2018-12116)"},{"value":"CVE-2018-0735","evidence":"OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)"},{"value":"CVE-2018-0734","evidence":"OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)"},{"value":"CVE-2018-5407","evidence":"OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:548fc980-6840-4bc0-bafd-a890ea2cfce9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases","advisory_id":"548fc980-6840-4bc0-bafd-a890ea2cfce9","event_types":["patch"],"published_at":"2026-10-25T14:34:29.804197+00:00","technologies":["node-js-10","node-js-11","node-js-6","node-js-8","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2018-11-28T00:55:46+00:00","detail_url":"/events/51926"},"members":[{"id":51926,"cve_ids":["CVE-2018-0734","CVE-2018-0735","CVE-2018-12116","CVE-2018-12120","CVE-2018-12121","CVE-2018-12122","CVE-2018-12123","CVE-2018-5407"],"payload":{"kind":"patch","title":"November 2018 Security Releases","summary":"Node.js security releases address multiple vulnerabilities across active release lines. Upgrade to the listed release versions; OpenSSL dependencies are also updated in Node.js 6, 8, 10 and 11.","evidence":"Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement (below).","products":[{"name":{"value":"Node.js 11","evidence":"Node.js 11.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.3.0","evidence":"Node.js 11.3.0 (Current)"}],"affected_versions":[{"value":"All versions of Node.js 11","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"Node.js 10","evidence":"Node.js 10.14.0 (LTS \"Dubnium\")"},"prerequisites":[],"fixed_versions":[{"value":"10.14.0","evidence":"Node.js 10.14.0 (LTS \"Dubnium\")"}],"affected_versions":[{"value":"All versions of Node.js 10","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"}]},{"name":{"value":"Node.js 8","evidence":"Node.js 8.14.0 (LTS \"Carbon\")"},"prerequisites":[],"fixed_versions":[{"value":"8.14.0","evidence":"Node.js 8.14.0 (LTS \"Carbon\")"}],"affected_versions":[{"value":"All versions of Node.js 8","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"}]},{"name":{"value":"Node.js 6","evidence":"Node.js 6.15.0 (LTS \"Boron\")"},"prerequisites":[],"fixed_versions":[{"value":"6.15.0","evidence":"Node.js 6.15.0 (LTS \"Boron\")"},{"value":"6.15.1","evidence":"Node.js 6.15.1 (LTS \"Boron\") was released to fix a misapplied backport"}],"affected_versions":[{"value":"All versions of Node.js 6","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-12120","evidence":"Debugger port 5858 listens on any interface by default (CVE-2018-12120)"},{"value":"CVE-2018-12121","evidence":"Denial of Service with large HTTP headers (CVE-2018-12121)"},{"value":"CVE-2018-12122","evidence":"\"Slowloris\" HTTP Denial of Service (CVE-2018-12122)"},{"value":"CVE-2018-12123","evidence":"Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)"},{"value":"CVE-2018-12116","evidence":"HTTP request splitting (CVE-2018-12116)"},{"value":"CVE-2018-0735","evidence":"OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)"},{"value":"CVE-2018-0734","evidence":"OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)"},{"value":"CVE-2018-5407","evidence":"OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:548fc980-6840-4bc0-bafd-a890ea2cfce9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases","advisory_id":"548fc980-6840-4bc0-bafd-a890ea2cfce9","event_types":["patch"],"published_at":"2026-10-25T14:34:29.804197+00:00","technologies":["node-js-10","node-js-11","node-js-6","node-js-8","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2018-11-28T00:55:46+00:00","detail_url":"/events/51926"}]}}],"next_after":52398,"next_before":52398}