{"schema_version":"1","view":"events","data":[{"id":19355,"advisory_id":"8e16ee33-ea42-492d-b81a-81a7af481c1c","group_id":"advisory:8e16ee33-ea42-492d-b81a-81a7af481c1c","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2025-security-releases","source_published_at":"2025-07-15T00:00:00+00:00","published_at":"2026-10-25T04:53:22.366016+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-27209","CVE-2025-27210"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js security releases for July 15, 2025","summary":"Node.js released updates addressing two high-severity issues: a Windows path traversal protection bypass and HashDoS in V8.","evidence":"Security releases available Updates are now available for the 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"The Node.js Project"},"prerequisites":[{"value":"Windows users of path.join API","evidence":"This vulnerability affects Windows users of path.join API."}],"fixed_versions":[{"value":"Node.js v20.19.4","evidence":"Node.js v20.19.4"},{"value":"Node.js v22.17.1","evidence":"Node.js v22.17.1"},{"value":"Node.js v24.4.1","evidence":"Node.js v24.4.1"}],"affected_versions":[{"value":"20.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x"},{"value":"22.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x"},{"value":"24.x","evidence":"This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x"}]}],"severity":"high","related_cves":[{"value":"CVE-2025-27210","evidence":"(CVE-2025-27210)"},{"value":"CVE-2025-27209","evidence":"(CVE-2025-27209)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"context_update":false,"detail_url":"/events/19355"},{"id":19354,"advisory_id":"8eaa5088-2046-4129-bfe2-7d31e4a26779","group_id":"advisory:8eaa5088-2046-4129-bfe2-7d31e4a26779","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.4.1","source_published_at":"2025-07-15T22:14:44+00:00","published_at":"2026-10-25T04:51:21.502685+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-27209","CVE-2025-27210"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 24.4.1 (Current)","summary":"Node.js 24.4.1 is a security release addressing HashDoS in V8 and a Windows reserved-device-name path traversal protection bypass.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.4.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"24.4.1","evidence":"Node.js 24.4.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-27209","evidence":"(CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm"},{"value":"CVE-2025-27210","evidence":"(CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/19354"},{"id":19353,"advisory_id":"5ade335d-978c-45c1-b04b-c6583b6c0770","group_id":"advisory:5ade335d-978c-45c1-b04b-c6583b6c0770","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.17.1","source_published_at":"2025-07-15T22:14:56+00:00","published_at":"2026-10-25T04:49:21.449963+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-27210"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 22.17.1 (LTS)","summary":"Node.js 22.17.1 is a security release addressing a Windows device-name bypass of path traversal protection in path.normalize().","evidence":"This is a security release. Notable Changes (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.17.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.17.1","evidence":"Version 22.17.1 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-27210","evidence":"(CVE-2025-27210)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/19353"},{"id":19352,"advisory_id":"82c3a4d5-9b22-41c2-afe9-07abb5e41bf6","group_id":"advisory:82c3a4d5-9b22-41c2-afe9-07abb5e41bf6","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.19.4","source_published_at":"2025-07-15T22:15:06+00:00","published_at":"2026-10-25T04:47:21.042289+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2025-27210"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.19.4 (LTS)","summary":"Node.js 20.19.4 is a security release addressing a path traversal protection bypass involving Windows device names in path.normalize().","evidence":"This is a security release. Notable Changes (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.19.4 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.19.4","evidence":"Node.js 20.19.4 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-27210","evidence":"(CVE-2025-27210) Windows Device Names"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/19352"}],"next_after":19355,"next_before":19352}