{"schema_version":"1","data":[{"id":24996,"advisory_id":"a0a2a4cb-8340-4760-a18e-dbc9f1e0492c","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.19.1","source_published_at":"2024-02-14T17:35:50+00:00","published_at":"2026-10-25T06:44:21.814872+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-46809","CVE-2024-21892","CVE-2024-22019","CVE-2024-22025"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.19.1 (LTS)","summary":"Node.js 18.19.1 is a security release addressing several vulnerabilities, including code injection and privilege escalation, denial of service, and a timing attack. The release explicitly rates some issues High and others Medium.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.19.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"18.19.1","evidence":"Version 18.19.1 'Hydrogen' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-21892","evidence":"CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)"},{"value":"CVE-2024-22019","evidence":"CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)"},{"value":"CVE-2023-46809","evidence":"CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)"},{"value":"CVE-2024-22025","evidence":"CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":24995,"advisory_id":"c1fbc529-84f4-4ab6-9302-bb5069fc7c48","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v21.6.2","source_published_at":"2024-02-14T17:36:06+00:00","published_at":"2026-10-25T06:44:20.083391+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-46809","CVE-2024-21890","CVE-2024-21891","CVE-2024-21892","CVE-2024-21896","CVE-2024-22017","CVE-2024-22019","CVE-2024-22025"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 21.6.2 (Current)","summary":"Node.js 21.6.2 is a security release addressing multiple vulnerabilities, including code injection, denial of service, path traversal, privilege escalation, and permission model bypasses.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 21.6.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"21.6.2","evidence":"Version 21.6.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-21892","evidence":"CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)"},{"value":"CVE-2024-22019","evidence":"CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)"},{"value":"CVE-2024-21896","evidence":"CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)"},{"value":"CVE-2024-22017","evidence":"CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)"},{"value":"CVE-2023-46809","evidence":"CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)"},{"value":"CVE-2024-21891","evidence":"CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)"},{"value":"CVE-2024-21890","evidence":"CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)"},{"value":"CVE-2024-22025","evidence":"CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":24814,"advisory_id":"b018dd0b-6658-4cb0-a729-b82e1ffc5fc9","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.11.1","source_published_at":"2024-02-14T17:35:59+00:00","published_at":"2026-10-25T06:41:22.346132+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-46809","CVE-2024-21890","CVE-2024-21891","CVE-2024-21892","CVE-2024-21896","CVE-2024-22017","CVE-2024-22019","CVE-2024-22025"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.11.1 (LTS)","summary":"Node.js 20.11.1 is a security release that addresses multiple security issues, including code injection, privilege escalation, denial of service, and permission model bypasses.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.11.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.11.1","evidence":"Version 20.11.1 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-21892","evidence":"CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities"},{"value":"CVE-2024-22019","evidence":"CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks"},{"value":"CVE-2024-21896","evidence":"CVE-2024-21896 - Path traversal by monkey-patching Buffer internals"},{"value":"CVE-2024-22017","evidence":"CVE-2024-22017 - setuid() does not drop all privileges due to io_uring"},{"value":"CVE-2023-46809","evidence":"CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack"},{"value":"CVE-2024-21891","evidence":"CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization"},{"value":"CVE-2024-21890","evidence":"CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write"},{"value":"CVE-2024-22025","evidence":"CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":24996,"next_before":24814}