{"schema_version":"1","data":[{"id":38959,"advisory_id":"24f30f8d-0424-491e-9c57-78bd74b9b83d","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v16.4.1","source_published_at":"2021-07-01T15:40:16+00:00","published_at":"2026-10-25T10:38:23.064965+00:00","extraction_method":"llm","technologies":["node-js","nodejs","windows-installer"],"cve_ids":["CVE-2021-22918","CVE-2021-22921"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 16.4.1 (Current)","summary":"Node.js 16.4.1 fixes two security vulnerabilities: an out-of-bounds read in libuv and Windows installer permission issues that could enable local privilege escalation.","evidence":"Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)","products":[{"name":{"value":"Node.js","evidence":"Node.js 16.4.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"16.4.1","evidence":"Node.js 16.4.1 (Current)"}],"affected_versions":[]},{"name":{"value":"Windows installer","evidence":"CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)"},"prerequisites":[{"value":"under certain conditions on Windows platforms","evidence":"Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms."}],"fixed_versions":[{"value":"16.4.1","evidence":"Windows 64-bit Installer: https://nodejs.org/dist/v16.4.1/node-v16.4.1-x64.msi"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-22918","evidence":"CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)"},{"value":"CVE-2021-22921","evidence":"CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":38566,"advisory_id":"5ae805a3-e868-47e2-b237-bfce2643b4bd","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.17.2","source_published_at":"2021-07-01T15:44:53+00:00","published_at":"2026-10-25T10:31:22.137798+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22918","CVE-2021-22921"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.17.2 (LTS)","summary":"Node.js 14.17.2 (LTS) fixes vulnerabilities involving an out-of-bounds read in libuv and Windows installer privilege escalation.","evidence":"Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.17.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 14.17.2","evidence":"Node.js 14.17.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-22918","evidence":"CVE-2021-22918: libuv upgrade - Out of bounds read"},{"value":"CVE-2021-22921","evidence":"CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":38385,"advisory_id":"1ae71cf4-130b-4200-a174-3dcd6b34f402","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2021-security-releases","source_published_at":"2021-07-01T16:00:00+00:00","published_at":"2026-10-25T10:28:23.645746+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22918","CVE-2021-22921","CVE-2021-23362","CVE-2021-27290"],"event_types":["patch"],"payload":{"kind":"patch","title":"July 2021 Security Releases","summary":"Node.js released security updates for the 12.x, 14.x, and 16.x release lines addressing vulnerabilities in libuv, the Windows installer, and npm dependencies.","evidence":"Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js release lines"},"prerequisites":[{"value":"Windows platforms","evidence":"under certain conditions on Windows platforms"}],"fixed_versions":[{"value":"Node.js v12.22.2 (LTS)","evidence":"Node.js v12.22.2 (LTS)"},{"value":"Node.js v14.17.2 (LTS)","evidence":"Node.js v14.17.2 (LTS)"},{"value":"Node.js v16.4.1 (LTS)","evidence":"Node.js v16.4.1 (LTS)"}],"affected_versions":[{"value":"All versions of the 16.x, 14.x, and 12.x releases lines","evidence":"Impacts: All versions of the 16.x, 14.x, and 12.x releases lines"},{"value":"All versions of the 12.x release line","evidence":"Impacts: All versions of the 12.x release line"},{"value":"Versions of the 14.x release line before 14.17.0","evidence":"Versions of the 14.x release line before 14.17.0 which included an update to the latest npm 6."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-22918","evidence":"Out of bounds read (Medium) (CVE-2021-22918)"},{"value":"CVE-2021-22921","evidence":"Node Installer Local Privilege Escalation (Medium) (CVE-2021-22921)"},{"value":"CVE-2021-27290","evidence":"Regular Expression Denial of Service (ReDoS) (High) (CVE-2021-27290)"},{"value":"CVE-2021-23362","evidence":"Regular Expression Denial of Service (ReDoS) (Medium) (CVE-2021-23362)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":38384,"advisory_id":"da6e2f24-2de0-42c9-8a0f-7c8e33c77976","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.22.2","source_published_at":"2021-07-01T15:42:17+00:00","published_at":"2026-10-25T10:28:22.192501+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22918","CVE-2021-22921","CVE-2021-23362","CVE-2021-27290"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.22.2 (LTS)","summary":"Node.js 12.22.2 fixes multiple listed vulnerabilities, including out-of-bounds read, Windows local privilege escalation, and denial-of-service flaws in npm dependencies.","evidence":"Vulnerabilities fixed: CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.22.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.22.2","evidence":"Node.js 12.22.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-22918","evidence":"CVE-2021-22918: libuv upgrade"},{"value":"CVE-2021-22921","evidence":"CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)"},{"value":"CVE-2021-27290","evidence":"CVE-2021-27290: npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High)"},{"value":"CVE-2021-23362","evidence":"CVE-2021-23362: npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":38959,"next_before":38384}