{"schema_version":"2","view":"grouped","data":[{"id":51662,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:385337ca-2a37-4205-b989-98fc48aaf927","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","event_types":["patch"],"published_at":"2026-10-25T14:19:53.423486+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:20+00:00","detail_url":"/advisories/advisory%3A385337ca-2a37-4205-b989-98fc48aaf927","group":{"id":"advisory:385337ca-2a37-4205-b989-98fc48aaf927","revision":1,"primary_event_id":51190,"change":"published","superseded_by":[],"changed":{"id":51190,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:385337ca-2a37-4205-b989-98fc48aaf927","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","event_types":["patch"],"published_at":"2026-10-25T14:19:53.423486+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:20+00:00","detail_url":"/events/51190"},"members":[{"id":51190,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:385337ca-2a37-4205-b989-98fc48aaf927","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","event_types":["patch"],"published_at":"2026-10-25T14:19:53.423486+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:20+00:00","detail_url":"/events/51190"}]}},{"id":51410,"cve_ids":["CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 10.15.2 (LTS)","summary":"Node.js 10.15.2 addresses a Slowloris HTTP denial-of-service vulnerability by applying the receive timeout consistently to keep-alive connections.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.15.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.15.2","evidence":"Node.js 10.15.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6094c592-f6d3-476e-9031-4ff22a56c073","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.15.2","advisory_id":"6094c592-f6d3-476e-9031-4ff22a56c073","event_types":["patch"],"published_at":"2026-10-25T14:15:22.088505+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:33+00:00","detail_url":"/advisories/advisory%3A6094c592-f6d3-476e-9031-4ff22a56c073","group":{"id":"advisory:6094c592-f6d3-476e-9031-4ff22a56c073","revision":1,"primary_event_id":50938,"change":"published","superseded_by":[],"changed":{"id":50938,"cve_ids":["CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 10.15.2 (LTS)","summary":"Node.js 10.15.2 addresses a Slowloris HTTP denial-of-service vulnerability by applying the receive timeout consistently to keep-alive connections.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.15.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.15.2","evidence":"Node.js 10.15.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6094c592-f6d3-476e-9031-4ff22a56c073","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.15.2","advisory_id":"6094c592-f6d3-476e-9031-4ff22a56c073","event_types":["patch"],"published_at":"2026-10-25T14:15:22.088505+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:33+00:00","detail_url":"/events/50938"},"members":[{"id":50938,"cve_ids":["CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 10.15.2 (LTS)","summary":"Node.js 10.15.2 addresses a Slowloris HTTP denial-of-service vulnerability by applying the receive timeout consistently to keep-alive connections.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.15.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.15.2","evidence":"Node.js 10.15.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6094c592-f6d3-476e-9031-4ff22a56c073","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.15.2","advisory_id":"6094c592-f6d3-476e-9031-4ff22a56c073","event_types":["patch"],"published_at":"2026-10-25T14:15:22.088505+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:33+00:00","detail_url":"/events/50938"}]}},{"id":51342,"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994776bd-8820-4102-9e7b-5aee22fde0a9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","event_types":["patch"],"published_at":"2026-10-25T14:14:02.756652+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:28+00:00","detail_url":"/advisories/advisory%3A994776bd-8820-4102-9e7b-5aee22fde0a9","group":{"id":"advisory:994776bd-8820-4102-9e7b-5aee22fde0a9","revision":1,"primary_event_id":50870,"change":"published","superseded_by":[],"changed":{"id":50870,"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994776bd-8820-4102-9e7b-5aee22fde0a9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","event_types":["patch"],"published_at":"2026-10-25T14:14:02.756652+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:28+00:00","detail_url":"/events/50870"},"members":[{"id":50870,"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994776bd-8820-4102-9e7b-5aee22fde0a9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","event_types":["patch"],"published_at":"2026-10-25T14:14:02.756652+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:28+00:00","detail_url":"/events/50870"}]}},{"id":51302,"cve_ids":["CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 11.10.1 (Current)","summary":"Node.js 11.10.1 includes a fix to prevent Slowloris attacks on HTTP and HTTPS keep-alive connections.","evidence":"A fix for the following CVE is included in this release: Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.10.1","evidence":"Node.js 11.10.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fc847dd3-7911-45c3-b2c6-e425aebc40b5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v11.10.1","advisory_id":"fc847dd3-7911-45c3-b2c6-e425aebc40b5","event_types":["patch"],"published_at":"2026-10-25T14:13:25.668282+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:37+00:00","detail_url":"/advisories/advisory%3Afc847dd3-7911-45c3-b2c6-e425aebc40b5","group":{"id":"advisory:fc847dd3-7911-45c3-b2c6-e425aebc40b5","revision":1,"primary_event_id":50830,"change":"published","superseded_by":[],"changed":{"id":50830,"cve_ids":["CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 11.10.1 (Current)","summary":"Node.js 11.10.1 includes a fix to prevent Slowloris attacks on HTTP and HTTPS keep-alive connections.","evidence":"A fix for the following CVE is included in this release: Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.10.1","evidence":"Node.js 11.10.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fc847dd3-7911-45c3-b2c6-e425aebc40b5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v11.10.1","advisory_id":"fc847dd3-7911-45c3-b2c6-e425aebc40b5","event_types":["patch"],"published_at":"2026-10-25T14:13:25.668282+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:37+00:00","detail_url":"/events/50830"},"members":[{"id":50830,"cve_ids":["CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 11.10.1 (Current)","summary":"Node.js 11.10.1 includes a fix to prevent Slowloris attacks on HTTP and HTTPS keep-alive connections.","evidence":"A fix for the following CVE is included in this release: Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.10.1","evidence":"Node.js 11.10.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fc847dd3-7911-45c3-b2c6-e425aebc40b5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v11.10.1","advisory_id":"fc847dd3-7911-45c3-b2c6-e425aebc40b5","event_types":["patch"],"published_at":"2026-10-25T14:13:25.668282+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:37+00:00","detail_url":"/events/50830"}]}},{"id":51106,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07c9cfd1-8fe4-45c9-be29-9ea600b239c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","event_types":["patch"],"published_at":"2026-10-25T14:10:27.337042+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:53:26+00:00","detail_url":"/advisories/advisory%3A07c9cfd1-8fe4-45c9-be29-9ea600b239c4","group":{"id":"advisory:07c9cfd1-8fe4-45c9-be29-9ea600b239c4","revision":1,"primary_event_id":50634,"change":"published","superseded_by":[],"changed":{"id":50634,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07c9cfd1-8fe4-45c9-be29-9ea600b239c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","event_types":["patch"],"published_at":"2026-10-25T14:10:27.337042+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:53:26+00:00","detail_url":"/events/50634"},"members":[{"id":50634,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07c9cfd1-8fe4-45c9-be29-9ea600b239c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","event_types":["patch"],"published_at":"2026-10-25T14:10:27.337042+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:53:26+00:00","detail_url":"/events/50634"}]}}],"next_after":51662,"next_before":51106}