{"schema_version":"1","data":[{"id":37020,"advisory_id":"ee1c89ec-2a8b-430c-a7e2-7edc53ab15db","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.22.5","source_published_at":"2021-08-11T16:41:05+00:00","published_at":"2026-10-25T10:05:23.886828+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22931","CVE-2021-22939","CVE-2021-22940","CVE-2021-3672"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.22.5 (LTS)","summary":"Node.js 12.22.5 (LTS) addresses vulnerabilities involving domain-name handling, HTTP/2 stream cancellation, and HTTPS certificate validation.","evidence":"CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.22.5 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.22.5","evidence":"Node.js 12.22.5 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3672","evidence":"CVE-2021-3672/CVE-2021-22931"},{"value":"CVE-2021-22931","evidence":"CVE-2021-3672/CVE-2021-22931"},{"value":"CVE-2021-22940","evidence":"CVE-2021-22940: Use after free on close http2 on stream canceling (High)"},{"value":"CVE-2021-22939","evidence":"CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":36923,"advisory_id":"d108efbb-4076-4410-ad46-b38ce7be5f38","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.17.5","source_published_at":"2021-08-11T16:41:40+00:00","published_at":"2026-10-25T10:03:25.030217+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22930","CVE-2021-22931","CVE-2021-22939","CVE-2021-22940","CVE-2021-3672"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.17.5 (LTS)","summary":"Node.js 14.17.5 addresses vulnerabilities involving DNS hostname validation, HTTP/2 stream cancellation, and HTTPS certificate validation. The release also includes a follow-up fix for CVE-2021-22930.","evidence":"This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix.","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.17.5 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"14.17.5","evidence":"Node.js 14.17.5 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3672","evidence":"CVE-2021-3672/CVE-2021-22931"},{"value":"CVE-2021-22931","evidence":"CVE-2021-3672/CVE-2021-22931"},{"value":"CVE-2021-22940","evidence":"CVE-2021-22940: Use after free on close http2 on stream canceling (High)"},{"value":"CVE-2021-22939","evidence":"CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)"},{"value":"CVE-2021-22930","evidence":"This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":36922,"advisory_id":"a7ab800b-af50-48ff-9581-5d23a5d29ba0","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v16.6.2","source_published_at":"2021-08-11T16:42:12+00:00","published_at":"2026-10-25T10:03:20.818782+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-22931","CVE-2021-22939","CVE-2021-22940","CVE-2021-3672"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 16.6.2 (Current)","summary":"Node.js 16.6.2 addresses reported security issues involving DNS hostname handling, HTTP/2 stream cancellation, and HTTPS certificate validation.","evidence":"CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)","products":[{"name":{"value":"Node.js","evidence":"Node.js 16.6.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"16.6.2","evidence":"Node.js 16.6.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3672","evidence":"CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)"},{"value":"CVE-2021-22931","evidence":"CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)"},{"value":"CVE-2021-22940","evidence":"CVE-2021-22940: Use after free on close http2 on stream canceling (High)"},{"value":"CVE-2021-22939","evidence":"CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":37020,"next_before":36922}