{"schema_version":"1","view":"events","data":[{"id":24633,"advisory_id":"d7d8b32d-4195-403a-840a-470a506f435f","group_id":"advisory:d7d8b32d-4195-403a-840a-470a506f435f","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/april-2024-security-releases","source_published_at":"2024-04-03T03:00:00+00:00","published_at":"2026-10-25T06:38:36.986237+00:00","extraction_method":"llm","technologies":["llhttp","node-js","nodejs","undici"],"cve_ids":["CVE-2024-27982","CVE-2024-27983"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js Security Releases — April 3, 2024","summary":"Node.js security releases address two vulnerabilities in the 18.x, 20.x, and 21.x release lines, including an HTTP/2 server crash and HTTP request smuggling. The release also updates llhttp and undici dependencies.","evidence":"Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"The Node.js Project"},"prerequisites":[],"fixed_versions":[{"value":"18.x","evidence":"Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues."},{"value":"20.x","evidence":"Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues."},{"value":"21.x","evidence":"Updates are now available for the v18.x, v20.x and 21.x Node.js release lines for the following issues."}],"affected_versions":[{"value":"18.x","evidence":"The 18.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue."},{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue."},{"value":"21.x","evidence":"The 21.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue."}]},{"name":{"value":"llhttp","evidence":"llhttp version 9.2.1 on 21.x, 20.x, and 18.x"},"prerequisites":[],"fixed_versions":[{"value":"9.2.1","evidence":"llhttp version 9.2.1 on 21.x, 20.x, and 18.x"}],"affected_versions":[]},{"name":{"value":"undici","evidence":"undici version 6.11.1 on 21.x"},"prerequisites":[],"fixed_versions":[{"value":"6.11.1","evidence":"undici version 6.11.1 on 21.x"},{"value":"5.28.4","evidence":"undici version 5.28.4 on 18.x and 20.x"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27983","evidence":"Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983)"},{"value":"CVE-2024-27982","evidence":"HTTP Request Smuggling via Content Length Obfuscation - (CVE-2024-27982)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/24633"},{"id":24332,"advisory_id":"c1992df0-f235-417c-ba80-cff538779e44","group_id":"advisory:c1992df0-f235-417c-ba80-cff538779e44","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.12.1","source_published_at":"2024-04-03T14:16:00+00:00","published_at":"2026-10-25T06:33:34.451866+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-27982","CVE-2024-27983"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.12.1 (LTS)","summary":"Node.js 20.12.1 is a security release addressing HTTP/2 server crashes and HTTP request smuggling.","evidence":"This is a security release","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.12.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.12.1","evidence":"Version 20.12.1 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27983","evidence":"CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)"},{"value":"CVE-2024-27982","evidence":"CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/24332"},{"id":24219,"advisory_id":"95359c89-63db-453d-b2ac-cff3b14b6f4c","group_id":"advisory:95359c89-63db-453d-b2ac-cff3b14b6f4c","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v21.7.2","source_published_at":"2024-04-03T14:18:52+00:00","published_at":"2026-10-25T06:31:45.136289+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-27982","CVE-2024-27983"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 21.7.2 (Current)","summary":"Node.js 21.7.2 is a security release addressing HTTP/2 server crashes and HTTP request smuggling.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 21.7.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"21.7.2","evidence":"Version 21.7.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27983","evidence":"CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)"},{"value":"CVE-2024-27982","evidence":"CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation- (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/24219"},{"id":24195,"advisory_id":"7d2c6ab4-a521-4991-955f-7cfb7ba6b60a","group_id":"advisory:7d2c6ab4-a521-4991-955f-7cfb7ba6b60a","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.20.1","source_published_at":"2024-04-03T14:27:39+00:00","published_at":"2026-10-25T06:31:26.804211+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-27982","CVE-2024-27983"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.20.1 (LTS)","summary":"Node.js 18.20.1 is a security release addressing an HTTP/2 server crash and HTTP request smuggling. The release identifies both issues as security fixes, but does not specify affected version ranges.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.20.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"18.20.1","evidence":"Version 18.20.1 'Hydrogen' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27983","evidence":"CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)"},{"value":"CVE-2024-27982","evidence":"CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/24195"}],"next_after":24633,"next_before":24195}