{"schema_version":"1","data":[{"id":26545,"advisory_id":"79190c90-1fde-46ef-9a3e-9b5bb66c9206","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/october-2023-security-releases","source_published_at":"2023-10-13T13:30:00+00:00","published_at":"2026-10-25T07:10:24.019608+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-38552","CVE-2023-39331","CVE-2023-39332","CVE-2023-39333","CVE-2023-44487","CVE-2023-45143"],"event_types":["patch"],"payload":{"kind":"patch","title":"Friday October 13 2023 Security Releases","summary":"Security updates are available for Node.js 18.x and 20.x, addressing vulnerabilities in undici, nghttp2, and Node.js features. Downloads include Node.js v18.18.2 and v20.8.1.","evidence":"Updates are now available for the v18.x and v20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.8.1 (Current)"},"prerequisites":[{"value":"experimental permission model","evidence":"This vulnerability affects all users using the experimental permission model in Node.js 20.x."},{"value":"experimental policy mechanism","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x."},{"value":"--experimental-wasm-modules command line option","evidence":"This vulnerability affects users of the --experimental-wasm-modules command line option in all active release lines 18.x and 20.x."}],"fixed_versions":[{"value":"v20.8.1","evidence":"Node.js v20.8.1 (Current)"},{"value":"v18.18.2","evidence":"Node.js v18.18.2 (LTS)"}],"affected_versions":[{"value":"18.x","evidence":"This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x."},{"value":"20.x","evidence":"This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x."}]}],"severity":"high","related_cves":[{"value":"CVE-2023-45143","evidence":"undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143)"},{"value":"CVE-2023-44487","evidence":"nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487)"},{"value":"CVE-2023-39331","evidence":"Permission model improperly protects against path traversal (High) - (CVE-2023-39331)"},{"value":"CVE-2023-39332","evidence":"Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332)"},{"value":"CVE-2023-38552","evidence":"Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552)"},{"value":"CVE-2023-39333","evidence":"Code injection via WebAssembly export names (Low) - (CVE-2023-39333)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":26544,"advisory_id":"8e677efc-38a5-4307-a397-21d2d6fde53a","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.8.1","source_published_at":"2023-10-13T21:08:42+00:00","published_at":"2026-10-25T07:10:19.718034+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-38552","CVE-2023-39331","CVE-2023-39332","CVE-2023-39333","CVE-2023-44487","CVE-2023-45143"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.8.1 (Current)","summary":"Node.js 20.8.1 fixes multiple security vulnerabilities, including issues involving nghttp2, undici, path traversal, policy integrity checks, and WebAssembly export names.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.8.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"20.8.1","evidence":"Node.js 20.8.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-44487","evidence":"CVE-2023-44487: nghttp2 Security Release (High)"},{"value":"CVE-2023-45143","evidence":"CVE-2023-45143: undici Security Release (High)"},{"value":"CVE-2023-39332","evidence":"CVE-2023-39332: Path traversal through path stored in Uint8Array (High)"},{"value":"CVE-2023-39331","evidence":"CVE-2023-39331: Permission model improperly protects against path traversal (High)"},{"value":"CVE-2023-38552","evidence":"CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium)"},{"value":"CVE-2023-39333","evidence":"CVE-2023-39333: Code injection via WebAssembly export names (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":26545,"next_before":26544}