{"schema_version":"1","data":[{"id":19879,"advisory_id":"8f40f5d0-de82-46fa-bdc1-4e599405259c","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/announcements/node-18-eol-support","source_published_at":"2025-06-06T12:00:00+00:00","published_at":"2026-10-25T05:18:22.36304+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2021-39135","CVE-2023-5678","CVE-2024-22019","CVE-2025-23167"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Beware of End-of-Life Node.js Versions - Upgrade or Seek Post-EOL Support","summary":"Node.js 18 and earlier are unsupported and do not receive security patches. The article advises upgrading to a supported Node.js version or obtaining commercial post-EOL support.","evidence":"Node.js 18 and all earlier versions are End-Of-Life. They are now completely unsupported, meaning they receive no updates, including security patches.","products":[{"name":{"value":"Node.js","evidence":"Node.js 18 and all earlier versions are End-Of-Life."},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"18 and all earlier versions","evidence":"Node.js 18 and all earlier versions are End-Of-Life."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23167","evidence":"https://nvd.nist.gov/vuln/detail/CVE-2025-23167 affects 18, 16, 14 (llhttp) - medium"},{"value":"CVE-2023-5678","evidence":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678 affects 16, 14 (openssl) - medium"},{"value":"CVE-2024-22019","evidence":"https://nvd.nist.gov/vuln/detail/CVE-2024-22019 affects 16, 14 (llhttp) - high"},{"value":"CVE-2021-39135","evidence":"https://nvd.nist.gov/vuln/detail/CVE-2021-39135 affects 14 (npm) - high"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19567,"advisory_id":"58be4558-643b-41d4-ad75-cae7d806525d","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/may-2025-security-releases","source_published_at":"2025-05-14T03:00:00+00:00","published_at":"2026-10-25T05:12:39.048963+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-23165","CVE-2025-23166","CVE-2025-23167"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js security releases available","summary":"Node.js security updates address three vulnerabilities affecting supported release lines. Updated releases include Node.js v20.19.2, v22.15.1, v23.11.1, and v24.0.2.","evidence":"Updates are now available for the 24.x, 23.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.19.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.19.2","evidence":"Node.js v20.19.2"},{"value":"Node.js v22.15.1","evidence":"Node.js v22.15.1"},{"value":"Node.js v23.11.1","evidence":"Node.js v23.11.1"},{"value":"Node.js v24.0.2","evidence":"Node.js v24.0.2"}],"affected_versions":[{"value":"20.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x"},{"value":"22.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x"},{"value":"23.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x"},{"value":"24.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x"}]},{"name":{"value":"Node.js","evidence":"A flaw in Node.js 20's HTTP parser"},"prerequisites":[],"fixed_versions":[{"value":"llhttp to version 9","evidence":"The issue was resolved by upgrading llhttp to version 9"}],"affected_versions":[{"value":"Node.js 20.x users prior to the llhttp v9 upgrade","evidence":"This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade."}]},{"name":{"value":"Node.js","evidence":"In Node.js, the ReadFileUtf8 internal binding"},"prerequisites":[{"value":"Windows systems relying on the ReadFileUtf8 API","evidence":"This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22."}],"fixed_versions":[{"value":"Node.js v20.19.2","evidence":"Node.js v20.19.2"},{"value":"Node.js v22.15.1","evidence":"Node.js v22.15.1"}],"affected_versions":[{"value":"v20 and v22","evidence":"This vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23166","evidence":"Improper error handling in async cryptographic operations crashes process (CVE-2025-23166)"},{"value":"CVE-2025-23167","evidence":"Improper HTTP header block termination in llhttp (CVE-2025-23167)"},{"value":"CVE-2025-23165","evidence":"Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19550,"advisory_id":"ef343c53-32f9-409d-a491-a4e6cdbb3b68","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.19.2","source_published_at":"2025-05-14T21:14:45+00:00","published_at":"2026-10-25T05:12:23.316693+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-27982","CVE-2025-23165","CVE-2025-23166","CVE-2025-23167"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.19.2 (LTS)","summary":"Node.js 20.19.2 is a security release that fixes issues in async crypto error handling and filesystem request cleanup, and updates llhttp.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.19.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.19.2","evidence":"Version 20.19.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-23166","evidence":"(CVE-2025-23166) fix error handling on async crypto operation"},{"value":"CVE-2025-23167","evidence":"(CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0"},{"value":"CVE-2025-23165","evidence":"(CVE-2025-23165) add missing call to uv_fs_req_cleanup"},{"value":"CVE-2024-27982","evidence":"(CVE-2024-27982) http: do not allow OBS fold in headers by default"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19879,"next_before":19550}