{"schema_version":"1","view":"events","data":[{"id":21055,"advisory_id":"50561a30-256e-485e-9132-40e4eae8cc64","group_id":"advisory:50561a30-256e-485e-9132-40e4eae8cc64","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.18.2","source_published_at":"2025-01-21T17:05:40+00:00","published_at":"2026-10-25T05:38:23.849468+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-22150","CVE-2025-23083","CVE-2025-23084","CVE-2025-23085"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.18.2 (LTS) security release","summary":"Node.js 20.18.2 (LTS) addresses multiple security issues, including flaws involving InternalWorker use, HTTP/2, Windows path normalization, and undici fetch().","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.18.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.18.2","evidence":"Version 20.18.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23083","evidence":"CVE-2025-23083 - throw on InternalWorker use when permission model is enabled (High)"},{"value":"CVE-2025-23085","evidence":"CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)"},{"value":"CVE-2025-23084","evidence":"CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)"},{"value":"CVE-2025-22150","evidence":"Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/21055"},{"id":20948,"advisory_id":"03e99ff7-fe8f-4aaa-94fd-21fa2ac512d1","group_id":"advisory:03e99ff7-fe8f-4aaa-94fd-21fa2ac512d1","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.13.1","source_published_at":"2025-01-21T17:05:48+00:00","published_at":"2026-10-25T05:36:33.994111+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-22150","CVE-2025-23083","CVE-2025-23084","CVE-2025-23085"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 22.13.1 (LTS)","summary":"Node.js 22.13.1 is a security release addressing multiple vulnerabilities, including issues involving the permission model, HTTP/2, Windows path normalization, and undici fetch().","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.13.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.13.1","evidence":"Version 22.13.1 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23083","evidence":"CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)"},{"value":"CVE-2025-23085","evidence":"CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)"},{"value":"CVE-2025-23084","evidence":"CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)"},{"value":"CVE-2025-22150","evidence":"Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/20948"},{"id":20939,"advisory_id":"7b2e0645-8111-48bd-a57e-2e660c9ab2dd","group_id":"advisory:7b2e0645-8111-48bd-a57e-2e660c9ab2dd","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v23.6.1","source_published_at":"2025-01-21T17:06:07+00:00","published_at":"2026-10-25T05:36:25.842661+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-22150","CVE-2025-23083","CVE-2025-23084","CVE-2025-23085"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 23.6.1 security release","summary":"Node.js 23.6.1 addresses security issues involving InternalWorker use with the permission model, HTTP/2 memory leakage, Windows path traversal, and insufficiently random values in undici fetch().","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 23.6.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"23.6.1","evidence":"Version 23.6.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23083","evidence":"CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)"},{"value":"CVE-2025-23085","evidence":"CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)"},{"value":"CVE-2025-23084","evidence":"CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)"},{"value":"CVE-2025-22150","evidence":"Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/20939"}],"next_after":21055,"next_before":20939}