{"schema_version":"1","data":[{"id":29062,"advisory_id":"57aee73f-34ba-4f03-8401-99c8c0b02d86","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2023-security-releases","source_published_at":"2023-02-16T21:00:00+00:00","published_at":"2026-10-25T07:52:20.253948+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-23918","CVE-2023-23919","CVE-2023-23920","CVE-2023-23936","CVE-2023-24807"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js Security Releases (Update 16-February-2023)","summary":"Node.js security releases address OpenSSL updates and multiple vulnerabilities across the 14.x, 16.x, 18.x, and 19.x release lines. Released versions are listed below.","evidence":"Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v14.21.3 (LTS)"},"prerequisites":[{"value":"--experimental-policy","evidence":"This only affects users who had enabled the experimental permissions option with --experimental-policy."}],"fixed_versions":[{"value":"v14.21.3","evidence":"Node.js v14.21.3 (LTS)"},{"value":"v16.19.1","evidence":"Node.js v16.19.1 (LTS)"},{"value":"v18.14.1","evidence":"Node.js v18.14.1 (LTS)"},{"value":"v19.6.1","evidence":"Node.js v19.6.1 (Current)"}],"affected_versions":[{"value":"19.x","evidence":"All versions of the 19.x, 18.x, 16.x, and 14.x release lines."},{"value":"18.x","evidence":"All versions of the 19.x, 18.x, 16.x, and 14.x release lines."},{"value":"16.x","evidence":"All versions of the 19.x, 18.x, 16.x, and 14.x release lines."},{"value":"14.x","evidence":"All versions of the 19.x, 18.x, 16.x, and 14.x release lines."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-23918","evidence":"Node.js Permissions policies can be bypassed via process.mainModule (High) (CVE-2023-23918)"},{"value":"CVE-2023-23919","evidence":"Node.js OpenSSL error handling issues in nodejs crypto library (Medium) (CVE-2023-23919)"},{"value":"CVE-2023-23936","evidence":"Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) (CVE-2023-23936)"},{"value":"CVE-2023-24807","evidence":"Regular Expression Denial of Service in Headers in Node.js fetch API(Low) (CVE-2023-24807)"},{"value":"CVE-2023-23920","evidence":"Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) (CVE-2023-23920)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":28880,"advisory_id":"e8849a53-ea44-4395-aff0-830ef05f65b5","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v16.19.1","source_published_at":"2023-02-16T22:16:31+00:00","published_at":"2026-10-25T07:49:37.408811+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-23918","CVE-2023-23919","CVE-2023-23920","CVE-2023-23936","CVE-2023-24807"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 16.19.1 (LTS)","summary":"Node.js 16.19.1 (LTS) fixes several security vulnerabilities, including issues in permissions policies, crypto, ICU data loading, and the Fetch API.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 16.19.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"16.19.1","evidence":"Node.js 16.19.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-23918","evidence":"CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)"},{"value":"CVE-2023-23919","evidence":"CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)"},{"value":"CVE-2023-23920","evidence":"CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)"},{"value":"CVE-2023-23936","evidence":"CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)"},{"value":"CVE-2023-24807","evidence":"CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":28760,"advisory_id":"0b271edc-82fb-4032-9263-c2cf5afef7cb","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.14.1","source_published_at":"2023-02-16T22:22:52+00:00","published_at":"2026-10-25T07:47:41.026486+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-23918","CVE-2023-23919","CVE-2023-23920","CVE-2023-23936","CVE-2023-24807"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.14.1 (LTS)","summary":"Node.js 18.14.1 fixes five listed CVEs and includes OpenSSL security updates.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.14.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"18.14.1","evidence":"Node.js 18.14.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-23918","evidence":"CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)"},{"value":"CVE-2023-23919","evidence":"CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)"},{"value":"CVE-2023-23936","evidence":"CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)"},{"value":"CVE-2023-24807","evidence":"CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)"},{"value":"CVE-2023-23920","evidence":"CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":29062,"next_before":28760}