{"schema_version":"1","view":"events","data":[{"id":21250,"advisory_id":"77f3b35e-537b-4344-963d-c0912927d5da","group_id":"advisory:77f3b35e-537b-4344-963d-c0912927d5da","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.20.6","source_published_at":"2025-01-21T17:05:27+00:00","published_at":"2026-10-25T05:41:20.492655+00:00","extraction_method":"llm","technologies":["node-js","nodejs","undici"],"cve_ids":["CVE-2025-22150","CVE-2025-23084","CVE-2025-23085"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.20.6 (LTS)","summary":"Node.js 18.20.6 is a security release fixing HTTP/2 memory leakage and Windows path traversal issues, and updating undici to address insufficiently random values in fetch().","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.20.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"18.20.6","evidence":"Version 18.20.6 'Hydrogen' (LTS)"}],"affected_versions":[]},{"name":{"value":"undici","evidence":"Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)"},"prerequisites":[],"fixed_versions":[{"value":"v5.28.5","evidence":"deps: update undici to v5.28.5"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23085","evidence":"CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)"},{"value":"CVE-2025-23084","evidence":"CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)"},{"value":"CVE-2025-22150","evidence":"CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/21250"}],"next_after":21250,"next_before":21250}