{"schema_version":"1","data":[{"id":36236,"advisory_id":"a48b0d18-7896-4560-8373-351adf3a60ad","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v16.11.1","source_published_at":"2021-10-12T15:35:28+00:00","published_at":"2026-10-25T09:52:23.786488+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22959","CVE-2021-22960"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 16.11.1 (Current)","summary":"Node.js 16.11.1 addresses two HTTP request smuggling issues involving spaces in headers and parsing chunked request bodies.","evidence":"CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)","products":[{"name":{"value":"Node.js","evidence":"Node.js 16.11.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"16.11.1","evidence":"Node.js 16.11.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-22959","evidence":"CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)"},{"value":"CVE-2021-22960","evidence":"CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":35957,"advisory_id":"99e16c1b-5a6d-465f-9885-d54dc90be03d","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.18.1","source_published_at":"2021-10-12T15:35:37+00:00","published_at":"2026-10-25T09:47:23.445057+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22959","CVE-2021-22960"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.18.1 (LTS)","summary":"Node.js 14.18.1 addresses two HTTP request smuggling issues involving spaces before header colons and chunked request body parsing.","evidence":"Node.js 14.18.1 (LTS) Notable changes CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.18.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"14.18.1","evidence":"Node.js 14.18.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-22959","evidence":"CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)"},{"value":"CVE-2021-22960","evidence":"CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":35956,"advisory_id":"c57109da-a340-4728-88ee-83af4b74771e","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.22.7","source_published_at":"2021-10-12T15:35:54+00:00","published_at":"2026-10-25T09:47:23.16014+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22959","CVE-2021-22960"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.22.7 (LTS)","summary":"Node.js 12.22.7 (LTS) addresses HTTP request smuggling issues involving spaces in headers and chunked request body parsing.","evidence":"Node.js 12.22.7 (LTS) Notable changes CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS).","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.22.7 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.22.7","evidence":"Node.js 12.22.7 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-22959","evidence":"CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)"},{"value":"CVE-2021-22960","evidence":"CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":35775,"advisory_id":"37dca5d4-bd59-4abd-a0e2-e9fa2e5a94f7","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases","source_published_at":"2021-10-12T16:00:00+00:00","published_at":"2026-10-25T09:44:22.418315+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22959","CVE-2021-22960"],"event_types":["patch"],"payload":{"kind":"patch","title":"October 12th 2021 Security Releases","summary":"Node.js released updates addressing two HTTP request smuggling issues across the 12.x, 14.x, and 16.x release lines.","evidence":"Updates are now available for the v16.x, v14.x, and v12.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v12.22.7 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v12.22.7 (LTS)","evidence":"Node.js v12.22.7 (LTS)"},{"value":"Node.js v14.18.1 (LTS)","evidence":"Node.js v14.18.1 (LTS)"},{"value":"Node.js v16.11.1 (Current)","evidence":"Node.js v16.11.1 (Current)"}],"affected_versions":[{"value":"All versions of the 16.x, 14.x, and 12.x releases lines.","evidence":"Impacts: All versions of the 16.x, 14.x, and 12.x releases lines."}]}],"severity":"medium","related_cves":[{"value":"CVE-2021-22959","evidence":"HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959)"},{"value":"CVE-2021-22960","evidence":"HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960)"}],"security_relevant":true,"severity_evidence":"Two medium severity issues"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"context_update":false}],"next_after":36236,"next_before":35775}