{"schema_version":"1","view":"events","data":[{"id":19567,"advisory_id":"58be4558-643b-41d4-ad75-cae7d806525d","group_id":"advisory:58be4558-643b-41d4-ad75-cae7d806525d","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/may-2025-security-releases","source_published_at":"2025-05-14T03:00:00+00:00","published_at":"2026-10-25T05:12:39.048963+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-23165","CVE-2025-23166","CVE-2025-23167"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js security releases available","summary":"Node.js security updates address three vulnerabilities affecting supported release lines. Updated releases include Node.js v20.19.2, v22.15.1, v23.11.1, and v24.0.2.","evidence":"Updates are now available for the 24.x, 23.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.19.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.19.2","evidence":"Node.js v20.19.2"},{"value":"Node.js v22.15.1","evidence":"Node.js v22.15.1"},{"value":"Node.js v23.11.1","evidence":"Node.js v23.11.1"},{"value":"Node.js v24.0.2","evidence":"Node.js v24.0.2"}],"affected_versions":[{"value":"20.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x"},{"value":"22.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x"},{"value":"23.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x"},{"value":"24.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x"}]},{"name":{"value":"Node.js","evidence":"A flaw in Node.js 20's HTTP parser"},"prerequisites":[],"fixed_versions":[{"value":"llhttp to version 9","evidence":"The issue was resolved by upgrading llhttp to version 9"}],"affected_versions":[{"value":"Node.js 20.x users prior to the llhttp v9 upgrade","evidence":"This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade."}]},{"name":{"value":"Node.js","evidence":"In Node.js, the ReadFileUtf8 internal binding"},"prerequisites":[{"value":"Windows systems relying on the ReadFileUtf8 API","evidence":"This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22."}],"fixed_versions":[{"value":"Node.js v20.19.2","evidence":"Node.js v20.19.2"},{"value":"Node.js v22.15.1","evidence":"Node.js v22.15.1"}],"affected_versions":[{"value":"v20 and v22","evidence":"This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23166","evidence":"Improper error handling in async cryptographic operations crashes process (CVE-2025-23166)"},{"value":"CVE-2025-23167","evidence":"Improper HTTP header block termination in llhttp (CVE-2025-23167)"},{"value":"CVE-2025-23165","evidence":"Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/19567"},{"id":19550,"advisory_id":"ef343c53-32f9-409d-a491-a4e6cdbb3b68","group_id":"advisory:ef343c53-32f9-409d-a491-a4e6cdbb3b68","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.19.2","source_published_at":"2025-05-14T21:14:45+00:00","published_at":"2026-10-25T05:12:23.316693+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-27982","CVE-2025-23165","CVE-2025-23166","CVE-2025-23167"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.19.2 (LTS)","summary":"Node.js 20.19.2 is a security release that fixes issues in async crypto error handling and filesystem request cleanup, and updates llhttp.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.19.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.19.2","evidence":"Version 20.19.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23166","evidence":"(CVE-2025-23166) fix error handling on async crypto operation"},{"value":"CVE-2025-23167","evidence":"(CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0"},{"value":"CVE-2025-23165","evidence":"(CVE-2025-23165) add missing call to uv_fs_req_cleanup"},{"value":"CVE-2024-27982","evidence":"(CVE-2024-27982) http: do not allow OBS fold in headers by default"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/19550"},{"id":19357,"advisory_id":"aebccf5a-3526-47f1-9567-3920ee235260","group_id":"advisory:aebccf5a-3526-47f1-9567-3920ee235260","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.15.1","source_published_at":"2025-05-14T21:15:50+00:00","published_at":"2026-10-25T05:08:21.735838+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-23165","CVE-2025-23166"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 22.15.1 (LTS)","summary":"Node.js 22.15.1 is a security release that fixes error handling for asynchronous crypto operations and adds a missing filesystem request cleanup call.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.15.1","evidence":"Version 22.15.1 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23166","evidence":"(CVE-2025-23166) fix error handling on async crypto operation"},{"value":"CVE-2025-23165","evidence":"(CVE-2025-23165) add missing call to uv_fs_req_cleanup"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/19357"}],"next_after":19567,"next_before":19357}