{"schema_version":"1","data":[{"id":36923,"advisory_id":"d108efbb-4076-4410-ad46-b38ce7be5f38","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.17.5","source_published_at":"2021-08-11T16:41:40+00:00","published_at":"2026-10-25T10:03:25.030217+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22930","CVE-2021-22931","CVE-2021-22939","CVE-2021-22940","CVE-2021-3672"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.17.5 (LTS)","summary":"Node.js 14.17.5 addresses vulnerabilities involving DNS hostname validation, HTTP/2 stream cancellation, and HTTPS certificate validation. The release also includes a follow-up fix for CVE-2021-22930.","evidence":"This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix.","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.17.5 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"14.17.5","evidence":"Node.js 14.17.5 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3672","evidence":"CVE-2021-3672/CVE-2021-22931"},{"value":"CVE-2021-22931","evidence":"CVE-2021-3672/CVE-2021-22931"},{"value":"CVE-2021-22940","evidence":"CVE-2021-22940: Use after free on close http2 on stream canceling (High)"},{"value":"CVE-2021-22939","evidence":"CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)"},{"value":"CVE-2021-22930","evidence":"This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":36923,"next_before":36923}