{"schema_version":"1","data":[{"id":51190,"advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","source_published_at":"2019-02-28T12:47:20+00:00","published_at":"2026-10-25T14:19:53.423486+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50938,"advisory_id":"6094c592-f6d3-476e-9031-4ff22a56c073","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.15.2","source_published_at":"2019-02-28T12:47:33+00:00","published_at":"2026-10-25T14:15:22.088505+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.15.2 (LTS)","summary":"Node.js 10.15.2 addresses a Slowloris HTTP denial-of-service vulnerability by applying the receive timeout consistently to keep-alive connections.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.15.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.15.2","evidence":"Node.js 10.15.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50870,"advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","source_published_at":"2019-02-28T12:47:28+00:00","published_at":"2026-10-25T14:14:02.756652+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50830,"advisory_id":"fc847dd3-7911-45c3-b2c6-e425aebc40b5","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v11.10.1","source_published_at":"2019-02-28T12:47:37+00:00","published_at":"2026-10-25T14:13:25.668282+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 11.10.1 (Current)","summary":"Node.js 11.10.1 includes a fix to prevent Slowloris attacks on HTTP and HTTPS keep-alive connections.","evidence":"A fix for the following CVE is included in this release: Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.10.1","evidence":"Node.js 11.10.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50634,"advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","source_published_at":"2019-02-28T12:53:26+00:00","published_at":"2026-10-25T14:10:27.337042+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"event_types":["patch"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":51190,"next_before":50634}