{"schema_version":"1","view":"events","data":[{"id":23139,"advisory_id":"b6e64f8b-6b33-4097-a173-1ddbdfd3a3b1","group_id":"advisory:b6e64f8b-6b33-4097-a173-1ddbdfd3a3b1","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2024-security-releases","source_published_at":"2024-07-08T03:00:00+00:00","published_at":"2026-10-25T06:13:27.214545+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-22018","CVE-2024-22020","CVE-2024-27980","CVE-2024-36137","CVE-2024-36138","CVE-2024-37372"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address five vulnerabilities across the 22.x, 20.x, and 18.x release lines. Downloads listed are Node.js v18.20.4, v20.15.1, and v22.4.1.","evidence":"Security releases available Updates are now available for the 22.x, 20.x, 18.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v18.20.4"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v18.20.4","evidence":"Node.js v18.20.4"},{"value":"Node.js v20.15.1","evidence":"Node.js v20.15.1"},{"value":"Node.js v22.4.1","evidence":"Node.js v22.4.1"}],"affected_versions":[{"value":"22.x","evidence":"Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x"},{"value":"20.x","evidence":"Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x"},{"value":"18.x","evidence":"Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27980","evidence":"Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138)"},{"value":"CVE-2024-36138","evidence":"Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138)"},{"value":"CVE-2024-22020","evidence":"Bypass network import restriction via data URL (CVE-2024-22020)"},{"value":"CVE-2024-36137","evidence":"fs.fchown/fchmod bypasses permission model (CVE-2024-36137)"},{"value":"CVE-2024-22018","evidence":"fs.lstat bypasses permission model (CVE-2024-22018)"},{"value":"CVE-2024-37372","evidence":"Permission model improperly processes UNC paths (CVE-2024-37372)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/23139"},{"id":23032,"advisory_id":"aba708fa-fcbd-42f4-81f4-553385cd97f4","group_id":"advisory:aba708fa-fcbd-42f4-81f4-553385cd97f4","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.20.4","source_published_at":"2024-07-08T18:15:09+00:00","published_at":"2026-10-25T06:11:22.664907+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-22020","CVE-2024-36138"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.20.4 (LTS)","summary":"Node.js 18.20.4 is a security release that addresses two listed vulnerabilities.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.20.4 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"18.20.4","evidence":"Version 18.20.4 'Hydrogen' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-36138","evidence":"CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)"},{"value":"CVE-2024-22020","evidence":"CVE-2024-22020 - Bypass network import restriction via data URL (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/23032"},{"id":23031,"advisory_id":"f3f71673-53a7-4767-9e03-7cf4e3e30147","group_id":"advisory:f3f71673-53a7-4767-9e03-7cf4e3e30147","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.4.1","source_published_at":"2024-07-09T02:31:49+00:00","published_at":"2026-10-25T06:11:22.518828+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-22018","CVE-2024-22020","CVE-2024-36137","CVE-2024-36138","CVE-2024-37372"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 22.4.1 (Current)","summary":"Node.js 22.4.1 is a security release addressing multiple vulnerabilities, including permission-model bypasses and a network-import restriction bypass.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.4.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"22.4.1","evidence":"Version 22.4.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-36138","evidence":"CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)"},{"value":"CVE-2024-22020","evidence":"CVE-2024-22020 - Bypass network import restriction via data URL (Medium)"},{"value":"CVE-2024-22018","evidence":"CVE-2024-22018 - fs.lstat bypasses permission model (Low)"},{"value":"CVE-2024-36137","evidence":"CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)"},{"value":"CVE-2024-37372","evidence":"CVE-2024-37372 - Permission model improperly processes UNC paths (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/23031"},{"id":22944,"advisory_id":"b62bb75c-9557-471f-9559-92d98dc54f24","group_id":"advisory:b62bb75c-9557-471f-9559-92d98dc54f24","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.15.1","source_published_at":"2024-07-08T18:16:32+00:00","published_at":"2026-10-25T06:10:22.617764+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-22018","CVE-2024-22020","CVE-2024-36137","CVE-2024-36138","CVE-2024-37372"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.15.1 (LTS)","summary":"Node.js 20.15.1 is a security release addressing several vulnerabilities involving network import restrictions and the permission model.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.15.1","evidence":"Version 20.15.1 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-36138","evidence":"CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)"},{"value":"CVE-2024-22020","evidence":"CVE-2024-22020 - Bypass network import restriction via data URL (Medium)"},{"value":"CVE-2024-22018","evidence":"CVE-2024-22018 - fs.lstat bypasses permission model (Low)"},{"value":"CVE-2024-36137","evidence":"CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)"},{"value":"CVE-2024-37372","evidence":"CVE-2024-37372 - Permission model improperly processes UNC paths (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/22944"}],"next_after":23139,"next_before":22944}