{"schema_version":"1","data":[{"id":45589,"advisory_id":"3707a798-8371-4552-80fd-62b229358149","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases","source_published_at":"2020-06-02T12:00:00+00:00","published_at":"2026-10-25T12:35:26.165873+00:00","extraction_method":"llm","technologies":["node-addon-api","node-js","nodejs"],"cve_ids":["CVE-2020-10531","CVE-2020-11080","CVE-2020-8172","CVE-2020-8174"],"event_types":["patch"],"payload":{"kind":"patch","title":"June 2020 Security Releases","summary":"Node.js released security updates for supported release lines addressing TLS session reuse, HTTP/2 settings-frame denial of service, N-API string-buffer memory corruption, and an ICU issue. Node.js 10.21.0, 12.18.0, and 14.4.0 are the listed releases.","evidence":"Updates are now available for all supported Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.21.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.21.0","evidence":"Node.js v10.21.0 (LTS)"},{"value":"12.18.0","evidence":"Node.js v12.18.0 (LTS)"},{"value":"14.4.0","evidence":"Node.js v14.4.0 (Current)"}],"affected_versions":[{"value":"10.x","evidence":"Affects Node.js 10.x, 12.x, and 14.x."},{"value":"12.x","evidence":"Affects Node.js 12.x, and 14.x."},{"value":"14.x","evidence":"Affects Node.js 12.x, and 14.x."}]},{"name":{"value":"node-addon-api","evidence":"https://www.npmjs.com/package/node-addon-api"},"prerequisites":[{"value":"when a native add-on is/was built using a version of Node.js that did not support N-API internally","evidence":"Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally."}],"fixed_versions":[],"affected_versions":[{"value":"1.x","evidence":"Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally."},{"value":"2.x","evidence":"Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8172","evidence":"TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172)"},{"value":"CVE-2020-11080","evidence":"HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080)"},{"value":"CVE-2020-8174","evidence":"napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174)"},{"value":"CVE-2020-10531","evidence":"ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":45588,"advisory_id":"20110e09-68fd-47a4-a330-640cacfa57ef","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.4.0","source_published_at":"2020-06-02T18:41:48+00:00","published_at":"2026-10-25T12:35:23.844116+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-11080","CVE-2020-8172","CVE-2020-8174"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.4.0 (Current)","summary":"Node.js 14.4.0 is a security release fixing TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption vulnerabilities.","evidence":"This is a security release. Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.4.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"14.4.0","evidence":"Node.js 14.4.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8172","evidence":"CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass"},{"value":"CVE-2020-11080","evidence":"CVE-2020-11080: HTTP/2 Large Settings Frame DoS"},{"value":"CVE-2020-8174","evidence":"CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":45501,"advisory_id":"2f172ae9-e77a-40a4-8462-db1d7eb9252c","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.18.0","source_published_at":"2020-06-02T18:41:58+00:00","published_at":"2026-10-25T12:34:22.842516+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-11080","CVE-2020-8172","CVE-2020-8174"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.18.0 (LTS)","summary":"Node.js 12.18.0 (LTS) is a security release that fixes three vulnerabilities, including TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption issues.","evidence":"This is a security release. Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.18.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.18.0","evidence":"Node.js 12.18.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8172","evidence":"CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High)."},{"value":"CVE-2020-11080","evidence":"CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low)."},{"value":"CVE-2020-8174","evidence":"CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High)."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":45589,"next_before":45501}