{"schema_version":"2","view":"grouped","data":[{"id":19486,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 20.20.0 (LTS) security release","summary":"Node.js 20.20.0 (LTS) is a security release that includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.0","evidence":"Version 20.20.0 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c17fccb-80de-4d27-be01-47d2ec6d5aab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.0","advisory_id":"4c17fccb-80de-4d27-be01-47d2ec6d5aab","event_types":["patch"],"published_at":"2026-10-25T04:22:23.150732+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:56:13+00:00","detail_url":"/advisories/advisory%3A4c17fccb-80de-4d27-be01-47d2ec6d5aab","group":{"id":"advisory:4c17fccb-80de-4d27-be01-47d2ec6d5aab","revision":1,"primary_event_id":19350,"change":"published","superseded_by":[],"changed":{"id":19350,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 20.20.0 (LTS) security release","summary":"Node.js 20.20.0 (LTS) is a security release that includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.0","evidence":"Version 20.20.0 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c17fccb-80de-4d27-be01-47d2ec6d5aab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.0","advisory_id":"4c17fccb-80de-4d27-be01-47d2ec6d5aab","event_types":["patch"],"published_at":"2026-10-25T04:22:23.150732+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:56:13+00:00","detail_url":"/events/19350"},"members":[{"id":19350,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 20.20.0 (LTS) security release","summary":"Node.js 20.20.0 (LTS) is a security release that includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.0","evidence":"Version 20.20.0 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4c17fccb-80de-4d27-be01-47d2ec6d5aab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.0","advisory_id":"4c17fccb-80de-4d27-be01-47d2ec6d5aab","event_types":["patch"],"published_at":"2026-10-25T04:22:23.150732+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:56:13+00:00","detail_url":"/events/19350"}]}},{"id":19485,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59464","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js security releases","summary":"Node.js released security updates for active 20.x, 22.x, 24.x, and 25.x lines, addressing multiple vulnerabilities. The announcement lists updated release versions and reports high, medium, and low severity issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address: 3 high severity issues. 4 medium severity issues. 1 low severity issue.","products":[{"name":{"value":"Node.js","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 20.20.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 22.22.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 24.13.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 25.3.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"}],"affected_versions":[{"value":"20.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x"},{"value":"22.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x"},{"value":"24.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x"},{"value":"25.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55131","evidence":"Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)"},{"value":"CVE-2025-55130","evidence":"Bypass File System Permissions using crafted symlinks (CVE-2025-55130)"},{"value":"CVE-2025-59465","evidence":"Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)"},{"value":"CVE-2025-59466","evidence":"Uncatchable \"Maximum call stack size exceeded\" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)"},{"value":"CVE-2025-59464","evidence":"Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)"},{"value":"CVE-2026-21636","evidence":"Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)"},{"value":"CVE-2026-21637","evidence":"TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)"},{"value":"CVE-2025-55132","evidence":"fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea970f25-395a-48bb-a1df-e7fea7115e12","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","advisory_id":"ea970f25-395a-48bb-a1df-e7fea7115e12","event_types":["patch"],"published_at":"2026-10-25T04:21:25.467226+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T00:00:00+00:00","detail_url":"/advisories/advisory%3Aea970f25-395a-48bb-a1df-e7fea7115e12","group":{"id":"advisory:ea970f25-395a-48bb-a1df-e7fea7115e12","revision":1,"primary_event_id":19349,"change":"published","superseded_by":[],"changed":{"id":19349,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59464","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js security releases","summary":"Node.js released security updates for active 20.x, 22.x, 24.x, and 25.x lines, addressing multiple vulnerabilities. The announcement lists updated release versions and reports high, medium, and low severity issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address: 3 high severity issues. 4 medium severity issues. 1 low severity issue.","products":[{"name":{"value":"Node.js","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 20.20.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 22.22.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 24.13.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 25.3.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"}],"affected_versions":[{"value":"20.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x"},{"value":"22.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x"},{"value":"24.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x"},{"value":"25.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55131","evidence":"Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)"},{"value":"CVE-2025-55130","evidence":"Bypass File System Permissions using crafted symlinks (CVE-2025-55130)"},{"value":"CVE-2025-59465","evidence":"Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)"},{"value":"CVE-2025-59466","evidence":"Uncatchable \"Maximum call stack size exceeded\" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)"},{"value":"CVE-2025-59464","evidence":"Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)"},{"value":"CVE-2026-21636","evidence":"Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)"},{"value":"CVE-2026-21637","evidence":"TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)"},{"value":"CVE-2025-55132","evidence":"fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea970f25-395a-48bb-a1df-e7fea7115e12","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","advisory_id":"ea970f25-395a-48bb-a1df-e7fea7115e12","event_types":["patch"],"published_at":"2026-10-25T04:21:25.467226+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T00:00:00+00:00","detail_url":"/events/19349"},"members":[{"id":19349,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59464","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js security releases","summary":"Node.js released security updates for active 20.x, 22.x, 24.x, and 25.x lines, addressing multiple vulnerabilities. The announcement lists updated release versions and reports high, medium, and low severity issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address: 3 high severity issues. 4 medium severity issues. 1 low severity issue.","products":[{"name":{"value":"Node.js","evidence":"Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 20.20.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 22.22.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 24.13.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"},{"value":"Node.js 25.3.0","evidence":"Downloads and release details Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0"}],"affected_versions":[{"value":"20.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x"},{"value":"22.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x"},{"value":"24.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x"},{"value":"25.x","evidence":"This security release includes the following dependency updates to address public vulnerabilities: c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-55131","evidence":"Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)"},{"value":"CVE-2025-55130","evidence":"Bypass File System Permissions using crafted symlinks (CVE-2025-55130)"},{"value":"CVE-2025-59465","evidence":"Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)"},{"value":"CVE-2025-59466","evidence":"Uncatchable \"Maximum call stack size exceeded\" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)"},{"value":"CVE-2025-59464","evidence":"Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)"},{"value":"CVE-2026-21636","evidence":"Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)"},{"value":"CVE-2026-21637","evidence":"TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)"},{"value":"CVE-2025-55132","evidence":"fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea970f25-395a-48bb-a1df-e7fea7115e12","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","advisory_id":"ea970f25-395a-48bb-a1df-e7fea7115e12","event_types":["patch"],"published_at":"2026-10-25T04:21:25.467226+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T00:00:00+00:00","detail_url":"/events/19349"}]}},{"id":19484,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.0 (LTS)","summary":"Node.js 24.13.0 is identified as a security release and includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.0","evidence":"Version 24.13.0 'Krypton' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e9f63da-41ca-4505-8203-bbff1cb2bf96","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.0","advisory_id":"4e9f63da-41ca-4505-8203-bbff1cb2bf96","event_types":["patch"],"published_at":"2026-10-25T04:19:22.436993+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:10+00:00","detail_url":"/advisories/advisory%3A4e9f63da-41ca-4505-8203-bbff1cb2bf96","group":{"id":"advisory:4e9f63da-41ca-4505-8203-bbff1cb2bf96","revision":1,"primary_event_id":19348,"change":"published","superseded_by":[],"changed":{"id":19348,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.0 (LTS)","summary":"Node.js 24.13.0 is identified as a security release and includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.0","evidence":"Version 24.13.0 'Krypton' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e9f63da-41ca-4505-8203-bbff1cb2bf96","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.0","advisory_id":"4e9f63da-41ca-4505-8203-bbff1cb2bf96","event_types":["patch"],"published_at":"2026-10-25T04:19:22.436993+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:10+00:00","detail_url":"/events/19348"},"members":[{"id":19348,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.0 (LTS)","summary":"Node.js 24.13.0 is identified as a security release and includes fixes associated with six CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.0","evidence":"Version 24.13.0 'Krypton' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e9f63da-41ca-4505-8203-bbff1cb2bf96","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.0","advisory_id":"4e9f63da-41ca-4505-8203-bbff1cb2bf96","event_types":["patch"],"published_at":"2026-10-25T04:19:22.436993+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:10+00:00","detail_url":"/events/19348"}]}},{"id":19483,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 25.3.0 (Current)","summary":"Node.js 25.3.0 is a security release containing fixes for multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.3.0","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2026-21636","evidence":"(CVE-2026-21636) add network check on pipe_wrap connect"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:765514b0-0a1f-47c5-a31e-d8b7312dec0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.3.0","advisory_id":"765514b0-0a1f-47c5-a31e-d8b7312dec0f","event_types":["patch"],"published_at":"2026-10-25T04:18:23.416156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:49+00:00","detail_url":"/advisories/advisory%3A765514b0-0a1f-47c5-a31e-d8b7312dec0f","group":{"id":"advisory:765514b0-0a1f-47c5-a31e-d8b7312dec0f","revision":1,"primary_event_id":19347,"change":"published","superseded_by":[],"changed":{"id":19347,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 25.3.0 (Current)","summary":"Node.js 25.3.0 is a security release containing fixes for multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.3.0","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2026-21636","evidence":"(CVE-2026-21636) add network check on pipe_wrap connect"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:765514b0-0a1f-47c5-a31e-d8b7312dec0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.3.0","advisory_id":"765514b0-0a1f-47c5-a31e-d8b7312dec0f","event_types":["patch"],"published_at":"2026-10-25T04:18:23.416156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:49+00:00","detail_url":"/events/19347"},"members":[{"id":19347,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21636","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 25.3.0 (Current)","summary":"Node.js 25.3.0 is a security release containing fixes for multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.3.0","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2026-21636","evidence":"(CVE-2026-21636) add network check on pipe_wrap connect"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:765514b0-0a1f-47c5-a31e-d8b7312dec0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.3.0","advisory_id":"765514b0-0a1f-47c5-a31e-d8b7312dec0f","event_types":["patch"],"published_at":"2026-10-25T04:18:23.416156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T13:58:49+00:00","detail_url":"/events/19347"}]}},{"id":19482,"cve_ids":["CVE-2025-59465","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.1 (LTS)","summary":"Node.js 24.13.1 includes fixes for CVE-2025-59465 and CVE-2026-21637.","evidence":"[32b03d0604] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.1","evidence":"Node.js 24.13.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) lib: add TLSSocket default error handler"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) tls: route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:13064459-4e71-4e46-a084-51b0f71a98c6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.1","advisory_id":"13064459-4e71-4e46-a084-51b0f71a98c6","event_types":["patch"],"published_at":"2026-10-25T04:16:21.646114+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-02-10T13:37:37+00:00","detail_url":"/advisories/advisory%3A13064459-4e71-4e46-a084-51b0f71a98c6","group":{"id":"advisory:13064459-4e71-4e46-a084-51b0f71a98c6","revision":1,"primary_event_id":19346,"change":"published","superseded_by":[],"changed":{"id":19346,"cve_ids":["CVE-2025-59465","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.1 (LTS)","summary":"Node.js 24.13.1 includes fixes for CVE-2025-59465 and CVE-2026-21637.","evidence":"[32b03d0604] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.1","evidence":"Node.js 24.13.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) lib: add TLSSocket default error handler"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) tls: route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:13064459-4e71-4e46-a084-51b0f71a98c6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.1","advisory_id":"13064459-4e71-4e46-a084-51b0f71a98c6","event_types":["patch"],"published_at":"2026-10-25T04:16:21.646114+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-02-10T13:37:37+00:00","detail_url":"/events/19346"},"members":[{"id":19346,"cve_ids":["CVE-2025-59465","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 24.13.1 (LTS)","summary":"Node.js 24.13.1 includes fixes for CVE-2025-59465 and CVE-2026-21637.","evidence":"[32b03d0604] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.13.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.13.1","evidence":"Node.js 24.13.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) lib: add TLSSocket default error handler"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) tls: route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:13064459-4e71-4e46-a084-51b0f71a98c6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.13.1","advisory_id":"13064459-4e71-4e46-a084-51b0f71a98c6","event_types":["patch"],"published_at":"2026-10-25T04:16:21.646114+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-02-10T13:37:37+00:00","detail_url":"/events/19346"}]}},{"id":19481,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 22.22.0 (LTS)","summary":"Node.js 22.22.0 is a security release that includes fixes for multiple listed CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.0","evidence":"Version 22.22.0 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.0","advisory_id":"c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","event_types":["patch"],"published_at":"2026-10-25T04:15:22.374422+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T14:18:09+00:00","detail_url":"/advisories/advisory%3Ac32909a8-96ac-4528-a7c7-bcb7ab4cb22e","group":{"id":"advisory:c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","revision":1,"primary_event_id":19345,"change":"published","superseded_by":[],"changed":{"id":19345,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 22.22.0 (LTS)","summary":"Node.js 22.22.0 is a security release that includes fixes for multiple listed CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.0","evidence":"Version 22.22.0 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.0","advisory_id":"c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","event_types":["patch"],"published_at":"2026-10-25T04:15:22.374422+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T14:18:09+00:00","detail_url":"/events/19345"},"members":[{"id":19345,"cve_ids":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"],"payload":{"kind":"patch","title":"Node.js 22.22.0 (LTS)","summary":"Node.js 22.22.0 is a security release that includes fixes for multiple listed CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.0","evidence":"Version 22.22.0 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-59465","evidence":"(CVE-2025-59465) add TLSSocket default error handler"},{"value":"CVE-2025-55132","evidence":"(CVE-2025-55132) disable futimes when permission model is enabled"},{"value":"CVE-2025-55130","evidence":"(CVE-2025-55130) require full read and write to symlink APIs"},{"value":"CVE-2025-59466","evidence":"(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks"},{"value":"CVE-2025-55131","evidence":"(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) route callback exceptions through error handlers"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.0","advisory_id":"c32909a8-96ac-4528-a7c7-bcb7ab4cb22e","event_types":["patch"],"published_at":"2026-10-25T04:15:22.374422+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T14:18:09+00:00","detail_url":"/events/19345"}]}},{"id":19478,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/advisories/advisory%3Aed18e8b9-148d-46af-aa8f-16ccebeea63a","group":{"id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","revision":1,"primary_event_id":19342,"change":"published","superseded_by":[],"changed":{"id":19342,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/events/19342"},"members":[{"id":19342,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/events/19342"}]}},{"id":19477,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 22.22.2 (LTS)","summary":"Node.js 22.22.2 is a security release addressing multiple vulnerabilities, with fixes listed as High, Medium, and Low.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.2","evidence":"Version 22.22.2 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:663acf7f-0966-4334-86bb-abda86423d0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.2","advisory_id":"663acf7f-0966-4334-86bb-abda86423d0f","event_types":["patch"],"published_at":"2026-10-25T03:56:22.40381+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:26+00:00","detail_url":"/advisories/advisory%3A663acf7f-0966-4334-86bb-abda86423d0f","group":{"id":"advisory:663acf7f-0966-4334-86bb-abda86423d0f","revision":1,"primary_event_id":19341,"change":"published","superseded_by":[],"changed":{"id":19341,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 22.22.2 (LTS)","summary":"Node.js 22.22.2 is a security release addressing multiple vulnerabilities, with fixes listed as High, Medium, and Low.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.2","evidence":"Version 22.22.2 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:663acf7f-0966-4334-86bb-abda86423d0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.2","advisory_id":"663acf7f-0966-4334-86bb-abda86423d0f","event_types":["patch"],"published_at":"2026-10-25T03:56:22.40381+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:26+00:00","detail_url":"/events/19341"},"members":[{"id":19341,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 22.22.2 (LTS)","summary":"Node.js 22.22.2 is a security release addressing multiple vulnerabilities, with fixes listed as High, Medium, and Low.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 22.22.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"22.22.2","evidence":"Version 22.22.2 'Jod' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:663acf7f-0966-4334-86bb-abda86423d0f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v22.22.2","advisory_id":"663acf7f-0966-4334-86bb-abda86423d0f","event_types":["patch"],"published_at":"2026-10-25T03:56:22.40381+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:26+00:00","detail_url":"/events/19341"}]}},{"id":19476,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 24.14.1 (LTS)","summary":"Node.js 24.14.1 is a security release that addresses multiple security issues.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.14.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.14.1","evidence":"Node.js 24.14.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712) handle url crash on different url formats"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.14.1","advisory_id":"b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","event_types":["patch"],"published_at":"2026-10-25T03:55:22.84483+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:31+00:00","detail_url":"/advisories/advisory%3Ab310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","group":{"id":"advisory:b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","revision":1,"primary_event_id":19340,"change":"published","superseded_by":[],"changed":{"id":19340,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 24.14.1 (LTS)","summary":"Node.js 24.14.1 is a security release that addresses multiple security issues.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.14.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.14.1","evidence":"Node.js 24.14.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712) handle url crash on different url formats"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.14.1","advisory_id":"b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","event_types":["patch"],"published_at":"2026-10-25T03:55:22.84483+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:31+00:00","detail_url":"/events/19340"},"members":[{"id":19340,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 24.14.1 (LTS)","summary":"Node.js 24.14.1 is a security release that addresses multiple security issues.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 24.14.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"24.14.1","evidence":"Node.js 24.14.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) test array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712) handle url crash on different url formats"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v24.14.1","advisory_id":"b310d021-e89c-4c2b-9e5b-0e8ff75f8fa8","event_types":["patch"],"published_at":"2026-10-25T03:55:22.84483+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:31+00:00","detail_url":"/events/19340"}]}},{"id":19475,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 20.20.2 (LTS)","summary":"Node.js 20.20.2 is a security release fixing multiple issues, including array index hash collision, timing-safe comparison, permission checks, and TLS callback handling.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.2","evidence":"Version 20.20.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) fix array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:457b022c-68b2-453d-8b2a-fdd41b27b76a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.2","advisory_id":"457b022c-68b2-453d-8b2a-fdd41b27b76a","event_types":["patch"],"published_at":"2026-10-25T03:54:22.366538+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:35:47+00:00","detail_url":"/advisories/advisory%3A457b022c-68b2-453d-8b2a-fdd41b27b76a","group":{"id":"advisory:457b022c-68b2-453d-8b2a-fdd41b27b76a","revision":1,"primary_event_id":19339,"change":"published","superseded_by":[],"changed":{"id":19339,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 20.20.2 (LTS)","summary":"Node.js 20.20.2 is a security release fixing multiple issues, including array index hash collision, timing-safe comparison, permission checks, and TLS callback handling.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.2","evidence":"Version 20.20.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) fix array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:457b022c-68b2-453d-8b2a-fdd41b27b76a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.2","advisory_id":"457b022c-68b2-453d-8b2a-fdd41b27b76a","event_types":["patch"],"published_at":"2026-10-25T03:54:22.366538+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:35:47+00:00","detail_url":"/events/19339"},"members":[{"id":19339,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 20.20.2 (LTS)","summary":"Node.js 20.20.2 is a security release fixing multiple issues, including array index hash collision, timing-safe comparison, permission checks, and TLS callback handling.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.20.2","evidence":"Version 20.20.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717) fix array index hash collision"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716) include permission check on lib/fs/promises"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715) add permission check to realpath.native"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code"},{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637) wrap SNICallback invocation in try/catch"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:457b022c-68b2-453d-8b2a-fdd41b27b76a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.20.2","advisory_id":"457b022c-68b2-453d-8b2a-fdd41b27b76a","event_types":["patch"],"published_at":"2026-10-25T03:54:22.366538+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:35:47+00:00","detail_url":"/events/19339"}]}},{"id":19474,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/advisories/advisory%3Aefc76334-94e6-45d6-a27d-f4816d1a32a8","group":{"id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","revision":1,"primary_event_id":19338,"change":"published","superseded_by":[],"changed":{"id":19338,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/events/19338"},"members":[{"id":19338,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/events/19338"}]}}],"next_after":19486,"next_before":19474}