{"schema_version":"1","data":[{"id":46730,"advisory_id":"78f963a5-1bf1-44fc-a22d-d3b862983eb2","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.15.0","source_published_at":"2020-02-06T03:13:05+00:00","published_at":"2026-10-25T13:02:22.827249+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-15604","CVE-2019-15605","CVE-2019-15606"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.15.0 (LTS)","summary":"Node.js 12.15.0 (LTS) is a security release that fixes three vulnerabilities and makes HTTP parsing stricter.","evidence":"This is a security release. Vulnerabilities fixed: CVE-2019-15606: HTTP header values do not have trailing OWS trimmed. CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header. CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.15.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.15.0","evidence":"Node.js 12.15.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-15606","evidence":"CVE-2019-15606: HTTP header values do not have trailing OWS trimmed."},{"value":"CVE-2019-15605","evidence":"CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header."},{"value":"CVE-2019-15604","evidence":"CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":46729,"advisory_id":"e9ba7781-2fa4-4635-9054-1ecdb6e7f128","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.19.0","source_published_at":"2020-02-06T03:11:18+00:00","published_at":"2026-10-25T13:01:43.301303+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-15604","CVE-2019-15605","CVE-2019-15606"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.19.0 (LTS)","summary":"Node.js 10.19.0 is a security release fixing three vulnerabilities and tightening HTTP parsing. The release notes warn that the insecure HTTP parser should be avoided.","evidence":"This is a security release. Vulnerabilities fixed:","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.19.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.19.0","evidence":"Node.js 10.19.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-15606","evidence":"CVE-2019-15606: HTTP header values do not have trailing OWS trimmed."},{"value":"CVE-2019-15605","evidence":"CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header."},{"value":"CVE-2019-15604","evidence":"CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":46704,"advisory_id":"e7b3e187-cc7b-4500-b9d5-c840c9974006","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v13.8.0","source_published_at":"2020-02-06T11:38:12+00:00","published_at":"2026-10-25T13:01:22.385711+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-15604","CVE-2019-15605","CVE-2019-15606"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 13.8.0 (Current)","summary":"Node.js 13.8.0 is a security release fixing three listed vulnerabilities and tightening HTTP parsing; the release notes describe an option to disable strict checks but advise against using it.","evidence":"This is a security release. Vulnerabilities fixed:","products":[{"name":{"value":"Node.js","evidence":"Node.js 13.8.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"13.8.0","evidence":"Node.js 13.8.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-15606","evidence":"CVE-2019-15606: HTTP header values do not have trailing OWS trimmed."},{"value":"CVE-2019-15605","evidence":"CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header."},{"value":"CVE-2019-15604","evidence":"CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":46500,"advisory_id":"609fa9a9-271c-47c7-8caf-2e3f4287d471","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2020-security-releases","source_published_at":"2020-02-06T12:00:00+00:00","published_at":"2026-10-25T12:57:26.794061+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-15604","CVE-2019-15605","CVE-2019-15606"],"event_types":["patch"],"payload":{"kind":"patch","title":"February 2020 Security Releases","summary":"Node.js released security updates for all active release lines, addressing HTTP request smuggling, HTTP header whitespace handling, and a TLS server crash, along with stricter HTTP parsing.","evidence":"Updates are now available for all active Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.19.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v10.19.0 (LTS)","evidence":"Node.js v10.19.0 (LTS)"},{"value":"Node.js v12.15.0 (LTS)","evidence":"Node.js v12.15.0 (LTS)"},{"value":"Node.js v13.8.0 (Current)","evidence":"Node.js v13.8.0 (Current)"}],"affected_versions":[{"value":"10.x","evidence":"All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable."},{"value":"12.x","evidence":"All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable."},{"value":"13.x","evidence":"All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-15605","evidence":"HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)"},{"value":"CVE-2019-15606","evidence":"HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606)"},{"value":"CVE-2019-15604","evidence":"Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":46730,"next_before":46500}