{"schema_version":"2","view":"grouped","data":[{"id":19486,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 20.20.0 (LTS) security release","summary":"Node.js 20.20.0 (LTS) is a security release that includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.0","evidence":"Version 20.20.0 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c17fccb-80de-4d27-be01-47d2ec6d5aab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.0","advisory_id":"4c17fccb-80de-4d27-be01-47d2ec6d5aab","event_types":["patch"],"published_at":"2026-10-25T04:22:23.150732+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:56:13+00:00","detail_url":"/advisories/advisory%3A4c17fccb-80de-4d27-be01-47d2ec6d5aab","group":{"id":"advisory:4c17fccb-80de-4d27-be01-47d2ec6d5aab","revision":1,"primary_event_id":19350,"change":"published","superseded_by":[],"changed":{"id":19350,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 20.20.0 (LTS) security release","summary":"Node.js 20.20.0 (LTS) is a security release that includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.0","evidence":"Version 20.20.0 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c17fccb-80de-4d27-be01-47d2ec6d5aab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.0","advisory_id":"4c17fccb-80de-4d27-be01-47d2ec6d5aab","event_types":["patch"],"published_at":"2026-10-25T04:22:23.150732+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:56:13+00:00","detail_url":"/events/19350"},"members":[{"id":19350,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 20.20.0 (LTS) security release","summary":"Node.js 20.20.0 (LTS) is a security release that includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.0","evidence":"Version 20.20.0 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c17fccb-80de-4d27-be01-47d2ec6d5aab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.0","advisory_id":"4c17fccb-80de-4d27-be01-47d2ec6d5aab","event_types":["patch"],"published_at":"2026-10-25T04:22:23.150732+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:56:13+00:00","detail_url":"/events/19350"}]}},{"id":19485,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59464","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js security releases","summary":"Node.js released security updates for active 20.x, 22.x, 24.x, and 25.x lines, addressing multiple vulnerabilities. The announcement lists updated release versions and reports high, medium, and low severity issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address: 3 high severity issues. 4 medium severity issues. 1 low severity issue.","products":[{"name":{"value":"Node.js","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 20.20.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 22.22.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 24.13.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 25.3.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"}],"affected_versions":[{"value":"20.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x"},{"value":"22.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x"},{"value":"24.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x"},{"value":"25.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55131","evidence":"Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)"},{"value":"CVE-2025-55130","evidence":"Bypass File System Permissions using crafted symlinks (CVE-2025-55130)"},{"value":"CVE-2025-59465","evidence":"Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)"},{"value":"CVE-2025-59466","evidence":"Uncatchable \"Maximum call stack size exceeded\" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)"},{"value":"CVE-2025-59464","evidence":"Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)"},{"value":"CVE-2026-21636","evidence":"Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)"},{"value":"CVE-2026-21637","evidence":"TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)"},{"value":"CVE-2025-55132","evidence":"fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea970f25-395a-48bb-a1df-e7fea7115e12","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","advisory_id":"ea970f25-395a-48bb-a1df-e7fea7115e12","event_types":["patch"],"published_at":"2026-10-25T04:21:25.467226+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T00:00:00+00:00","detail_url":"/advisories/advisory%3Aea970f25-395a-48bb-a1df-e7fea7115e12","group":{"id":"advisory:ea970f25-395a-48bb-a1df-e7fea7115e12","revision":1,"primary_event_id":19349,"change":"published","superseded_by":[],"changed":{"id":19349,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59464","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js security releases","summary":"Node.js released security updates for active 20.x, 22.x, 24.x, and 25.x lines, addressing multiple vulnerabilities. The announcement lists updated release versions and reports high, medium, and low severity issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address: 3 high severity issues. 4 medium severity issues. 1 low severity issue.","products":[{"name":{"value":"Node.js","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 20.20.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 22.22.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 24.13.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 25.3.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"}],"affected_versions":[{"value":"20.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x"},{"value":"22.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x"},{"value":"24.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x"},{"value":"25.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55131","evidence":"Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)"},{"value":"CVE-2025-55130","evidence":"Bypass File System Permissions using crafted symlinks (CVE-2025-55130)"},{"value":"CVE-2025-59465","evidence":"Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)"},{"value":"CVE-2025-59466","evidence":"Uncatchable \"Maximum call stack size exceeded\" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)"},{"value":"CVE-2025-59464","evidence":"Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)"},{"value":"CVE-2026-21636","evidence":"Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)"},{"value":"CVE-2026-21637","evidence":"TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)"},{"value":"CVE-2025-55132","evidence":"fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea970f25-395a-48bb-a1df-e7fea7115e12","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","advisory_id":"ea970f25-395a-48bb-a1df-e7fea7115e12","event_types":["patch"],"published_at":"2026-10-25T04:21:25.467226+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T00:00:00+00:00","detail_url":"/events/19349"},"members":[{"id":19349,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59464","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js security releases","summary":"Node.js released security updates for active 20.x, 22.x, 24.x, and 25.x lines, addressing multiple vulnerabilities. The announcement lists updated release versions and reports high, medium, and low severity issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address: 3 high severity issues. 4 medium severity issues. 1 low severity issue.","products":[{"name":{"value":"Node.js","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 20.20.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 22.22.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 24.13.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 25.3.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"}],"affected_versions":[{"value":"20.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x"},{"value":"22.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x"},{"value":"24.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x"},{"value":"25.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55131","evidence":"Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)"},{"value":"CVE-2025-55130","evidence":"Bypass File System Permissions using crafted symlinks (CVE-2025-55130)"},{"value":"CVE-2025-59465","evidence":"Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)"},{"value":"CVE-2025-59466","evidence":"Uncatchable \"Maximum call stack size exceeded\" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)"},{"value":"CVE-2025-59464","evidence":"Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)"},{"value":"CVE-2026-21636","evidence":"Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)"},{"value":"CVE-2026-21637","evidence":"TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)"},{"value":"CVE-2025-55132","evidence":"fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea970f25-395a-48bb-a1df-e7fea7115e12","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","advisory_id":"ea970f25-395a-48bb-a1df-e7fea7115e12","event_types":["patch"],"published_at":"2026-10-25T04:21:25.467226+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T00:00:00+00:00","detail_url":"/events/19349"}]}},{"id":19484,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.0 (LTS)","summary":"Node.js 24.13.0 is identified as a security release and includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.0","evidence":"Version 24.13.0 'Krypton' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e9f63da-41ca-4505-8203-bbff1cb2bf96","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.0","advisory_id":"4e9f63da-41ca-4505-8203-bbff1cb2bf96","event_types":["patch"],"published_at":"2026-10-25T04:19:22.436993+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:10+00:00","detail_url":"/advisories/advisory%3A4e9f63da-41ca-4505-8203-bbff1cb2bf96","group":{"id":"advisory:4e9f63da-41ca-4505-8203-bbff1cb2bf96","revision":1,"primary_event_id":19348,"change":"published","superseded_by":[],"changed":{"id":19348,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.0 (LTS)","summary":"Node.js 24.13.0 is identified as a security release and includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.0","evidence":"Version 24.13.0 'Krypton' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e9f63da-41ca-4505-8203-bbff1cb2bf96","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.0","advisory_id":"4e9f63da-41ca-4505-8203-bbff1cb2bf96","event_types":["patch"],"published_at":"2026-10-25T04:19:22.436993+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:10+00:00","detail_url":"/events/19348"},"members":[{"id":19348,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.0 (LTS)","summary":"Node.js 24.13.0 is identified as a security release and includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.0","evidence":"Version 24.13.0 'Krypton' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e9f63da-41ca-4505-8203-bbff1cb2bf96","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.0","advisory_id":"4e9f63da-41ca-4505-8203-bbff1cb2bf96","event_types":["patch"],"published_at":"2026-10-25T04:19:22.436993+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:10+00:00","detail_url":"/events/19348"}]}},{"id":19483,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 25.3.0 (Current)","summary":"Node.js 25.3.0 is a security release containing fixes for multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.3.0","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2026-21636","evidence":"(CVE-2026-21636) add network check on pipe_wrap connect"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:765514b0-0a1f-47c5-a31e-d8b7312dec0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.3.0","advisory_id":"765514b0-0a1f-47c5-a31e-d8b7312dec0f","event_types":["patch"],"published_at":"2026-10-25T04:18:23.416156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:49+00:00","detail_url":"/advisories/advisory%3A765514b0-0a1f-47c5-a31e-d8b7312dec0f","group":{"id":"advisory:765514b0-0a1f-47c5-a31e-d8b7312dec0f","revision":1,"primary_event_id":19347,"change":"published","superseded_by":[],"changed":{"id":19347,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 25.3.0 (Current)","summary":"Node.js 25.3.0 is a security release containing fixes for multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.3.0","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2026-21636","evidence":"(CVE-2026-21636) add network check on pipe_wrap connect"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:765514b0-0a1f-47c5-a31e-d8b7312dec0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.3.0","advisory_id":"765514b0-0a1f-47c5-a31e-d8b7312dec0f","event_types":["patch"],"published_at":"2026-10-25T04:18:23.416156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:49+00:00","detail_url":"/events/19347"},"members":[{"id":19347,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 25.3.0 (Current)","summary":"Node.js 25.3.0 is a security release containing fixes for multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.3.0","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2026-21636","evidence":"(CVE-2026-21636) add network check on pipe_wrap connect"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:765514b0-0a1f-47c5-a31e-d8b7312dec0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.3.0","advisory_id":"765514b0-0a1f-47c5-a31e-d8b7312dec0f","event_types":["patch"],"published_at":"2026-10-25T04:18:23.416156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:49+00:00","detail_url":"/events/19347"}]}},{"id":19482,"cve_ids":["CVE-2025-59465","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.1 (LTS)","summary":"Node.js 24.13.1 includes fixes for CVE-2025-59465 and CVE-2026-21637.","evidence":"[32b03d0604] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.1","evidence":"Node.js 24.13.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) lib: add TLSSocket default error handler"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) tls: route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:13064459-4e71-4e46-a084-51b0f71a98c6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.1","advisory_id":"13064459-4e71-4e46-a084-51b0f71a98c6","event_types":["patch"],"published_at":"2026-10-25T04:16:21.646114+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-02-10T13:37:37+00:00","detail_url":"/advisories/advisory%3A13064459-4e71-4e46-a084-51b0f71a98c6","group":{"id":"advisory:13064459-4e71-4e46-a084-51b0f71a98c6","revision":1,"primary_event_id":19346,"change":"published","superseded_by":[],"changed":{"id":19346,"cve_ids":["CVE-2025-59465","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.1 (LTS)","summary":"Node.js 24.13.1 includes fixes for CVE-2025-59465 and CVE-2026-21637.","evidence":"[32b03d0604] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.1","evidence":"Node.js 24.13.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) lib: add TLSSocket default error handler"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) tls: route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:13064459-4e71-4e46-a084-51b0f71a98c6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.1","advisory_id":"13064459-4e71-4e46-a084-51b0f71a98c6","event_types":["patch"],"published_at":"2026-10-25T04:16:21.646114+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-02-10T13:37:37+00:00","detail_url":"/events/19346"},"members":[{"id":19346,"cve_ids":["CVE-2025-59465","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.1 (LTS)","summary":"Node.js 24.13.1 includes fixes for CVE-2025-59465 and CVE-2026-21637.","evidence":"[32b03d0604] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.1","evidence":"Node.js 24.13.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) lib: add TLSSocket default error handler"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) tls: route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:13064459-4e71-4e46-a084-51b0f71a98c6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.1","advisory_id":"13064459-4e71-4e46-a084-51b0f71a98c6","event_types":["patch"],"published_at":"2026-10-25T04:16:21.646114+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-02-10T13:37:37+00:00","detail_url":"/events/19346"}]}},{"id":19481,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 22.22.0 (LTS)","summary":"Node.js 22.22.0 is a security release that includes fixes for multiple listed CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.0","evidence":"Version 22.22.0 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.0","advisory_id":"c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","event_types":["patch"],"published_at":"2026-10-25T04:15:22.374422+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T14:18:09+00:00","detail_url":"/advisories/advisory%3Ac32909a8-96ac-4528-a7c7-bcb7ab4cb22e","group":{"id":"advisory:c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","revision":1,"primary_event_id":19345,"change":"published","superseded_by":[],"changed":{"id":19345,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 22.22.0 (LTS)","summary":"Node.js 22.22.0 is a security release that includes fixes for multiple listed CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.0","evidence":"Version 22.22.0 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.0","advisory_id":"c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","event_types":["patch"],"published_at":"2026-10-25T04:15:22.374422+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T14:18:09+00:00","detail_url":"/events/19345"},"members":[{"id":19345,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 22.22.0 (LTS)","summary":"Node.js 22.22.0 is a security release that includes fixes for multiple listed CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.0","evidence":"Version 22.22.0 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.0","advisory_id":"c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","event_types":["patch"],"published_at":"2026-10-25T04:15:22.374422+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T14:18:09+00:00","detail_url":"/events/19345"}]}}],"next_after":19486,"next_before":19481}