{"schema_version":"1","data":[{"id":31728,"advisory_id":"67136cd0-a74b-4df4-96a4-b707a24d2493","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases","source_published_at":"2022-07-07T16:00:00+00:00","published_at":"2026-10-25T08:37:27.233472+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2022-2097","CVE-2022-32212","CVE-2022-32213","CVE-2022-32214","CVE-2022-32215","CVE-2022-32222","CVE-2022-32223"],"event_types":["patch"],"payload":{"kind":"patch","title":"July 7th 2022 Security Releases","summary":"Node.js security releases address multiple vulnerabilities in the 14.x, 16.x, and 18.x release lines. Downloads are listed for Node.js v14.20.0, v16.16.0, and v18.5.0.","evidence":"Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v14.20.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v14.20.0 (LTS)","evidence":"Node.js v14.20.0 (LTS)"},{"value":"Node.js v16.16.0 (LTS)","evidence":"Node.js v16.16.0 (LTS)"},{"value":"Node.js v18.5.0 (Current)","evidence":"Node.js v18.5.0 (Current)"}],"affected_versions":[{"value":"All versions of the 18.x, 16.x, and 14.x releases lines","evidence":"Impacts: All versions of the 18.x, 16.x, and 14.x releases lines."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2022-32213","evidence":"HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213)"},{"value":"CVE-2022-32214","evidence":"HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214)"},{"value":"CVE-2022-32215","evidence":"HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215)"},{"value":"CVE-2022-32212","evidence":"DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212)"},{"value":"CVE-2022-32223","evidence":"DLL Hijacking on Windows (High)(CVE-2022-32223)"},{"value":"CVE-2022-32222","evidence":"Attempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)(CVE-2022-32222)"},{"value":"CVE-2022-2097","evidence":"OpenSSL - AES OCB fails to encrypt some bytes (Medium)(CVE-2022-2097)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":31124,"advisory_id":"2d348030-ed25-461a-a53b-c35896a0f336","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/september-2022-security-releases","source_published_at":"2022-09-15T16:00:00+00:00","published_at":"2026-10-25T08:27:25.851266+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-7160","CVE-2022-32212","CVE-2022-32213","CVE-2022-32222","CVE-2022-35255","CVE-2022-35256"],"event_types":["patch"],"payload":{"kind":"patch","title":"September 23rd 2022 Security Releases","summary":"Node.js released security updates for the 18.x, 16.x, and 14.x release lines addressing DNS rebinding, HTTP request smuggling, and other vulnerabilities.","evidence":"Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v14.20.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v14.20.1 (LTS)","evidence":"Node.js v14.20.1 (LTS)"},{"value":"Node.js v16.17.1 (LTS)","evidence":"Node.js v16.17.1 (LTS)"},{"value":"Node.js v18.9.1 (Current)","evidence":"Node.js v18.9.1 (Current)"}],"affected_versions":[{"value":"All versions of the 18.x, 16.x, and 14.x release lines","evidence":"Impacts: All versions of the 18.x, 16.x, and 14.x release lines."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2022-32212","evidence":"DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)"},{"value":"CVE-2018-7160","evidence":"DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) (High) (CVE-2022-32212, CVE-2018-7160)"},{"value":"CVE-2022-32213","evidence":"CVE-2022-32213 bypass via obs-fold mechanic (Medium) (CVE-2022-32213)"},{"value":"CVE-2022-35256","evidence":"HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) (CVE-2022-35256)"},{"value":"CVE-2022-32222","evidence":"Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on macOS (Medium) (CVE-2022-32222)"},{"value":"CVE-2022-35255","evidence":"Weak randomness in WebCrypto keygen (High) (CVE-2022-35255)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":30913,"advisory_id":"50670081-9b33-42c6-baae-7c7bc8342d42","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.20.1","source_published_at":"2022-09-23T16:13:35+00:00","published_at":"2026-10-25T08:23:35.414009+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2022-32212","CVE-2022-32213","CVE-2022-35256"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.20.1 (LTS)","summary":"Node.js 14.20.1 fixes three listed CVEs, including DNS rebinding in --inspect on macOS and HTTP request smuggling.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.20.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"14.20.1","evidence":"Node.js 14.20.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2022-32212","evidence":"CVE-2022-32212: DNS rebinding in --inspect on macOS (High)"},{"value":"CVE-2022-32213","evidence":"CVE-2022-32213: bypass via obs-fold mechanic (Medium)"},{"value":"CVE-2022-35256","evidence":"CVE-2022-35256: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":30896,"advisory_id":"15004835-6178-4bec-8f68-78bace6842cc","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.9.1","source_published_at":"2022-09-23T16:14:04+00:00","published_at":"2026-10-25T08:23:22.754842+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2022-32212","CVE-2022-32213","CVE-2022-32215","CVE-2022-32222","CVE-2022-35255","CVE-2022-35256"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.9.1 (Current)","summary":"Node.js 18.9.1 fixes multiple security vulnerabilities, including DNS rebinding, OpenSSL configuration file handling, HTTP request smuggling, and weak randomness in WebCrypto key generation.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.9.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"18.9.1","evidence":"Node.js 18.9.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2022-32212","evidence":"CVE-2022-32212: DNS rebinding in --inspect on macOS (High)"},{"value":"CVE-2022-32222","evidence":"CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)"},{"value":"CVE-2022-32213","evidence":"CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)"},{"value":"CVE-2022-32215","evidence":"CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)"},{"value":"CVE-2022-35256","evidence":"CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)"},{"value":"CVE-2022-35255","evidence":"CVE-2022-35255: Weak randomness in WebCrypto keygen"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":31728,"next_before":30896}