{"schema_version":"2","view":"grouped","data":[{"id":19478,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/advisories/advisory%3Aed18e8b9-148d-46af-aa8f-16ccebeea63a","group":{"id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","revision":1,"primary_event_id":19342,"change":"published","superseded_by":[],"changed":{"id":19342,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/events/19342"},"members":[{"id":19342,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address multiple vulnerabilities across the 20.x, 22.x, 24.x, and 25.x release lines. The announcement lists fixes for denial of service, permission model bypasses, crashes, and other issues.","evidence":"Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v20.20.2"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v20.20.2","evidence":"Node.js v20.20.2"},{"value":"Node.js v22.22.2","evidence":"Node.js v22.22.2"},{"value":"Node.js v24.14.1","evidence":"Node.js v24.14.1"},{"value":"Node.js v25.8.2","evidence":"Node.js v25.8.2"}],"affected_versions":[{"value":"20.x","evidence":"The 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"22.x","evidence":"The 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"24.x","evidence":"The 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues."},{"value":"25.x","evidence":"The 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues."}]}],"severity":"high","related_cves":[{"value":"CVE-2026-21637","evidence":"Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"Node.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"Assertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714)"},{"value":"CVE-2026-21717","evidence":"HashDoS in V8 (CVE-2026-21717)"},{"value":"CVE-2026-21715","evidence":"Permission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716)"}],"security_relevant":true,"severity_evidence":"2 high severity issues."},"group_id":"advisory:ed18e8b9-148d-46af-aa8f-16ccebeea63a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","advisory_id":"ed18e8b9-148d-46af-aa8f-16ccebeea63a","event_types":["patch"],"published_at":"2026-10-25T03:57:28.996522+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T03:00:00+00:00","detail_url":"/events/19342"}]}},{"id":19474,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/advisories/advisory%3Aefc76334-94e6-45d6-a27d-f4816d1a32a8","group":{"id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","revision":1,"primary_event_id":19338,"change":"published","superseded_by":[],"changed":{"id":19338,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/events/19338"},"members":[{"id":19338,"cve_ids":["CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"payload":{"kind":"patch","title":"Node.js 25.8.2 (Current)","summary":"Node.js 25.8.2 is a security release addressing multiple CVEs.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 25.8.2 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"25.8.2","evidence":"Version 25.8.2 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-21637","evidence":"(CVE-2026-21637)"},{"value":"CVE-2026-21710","evidence":"(CVE-2026-21710)"},{"value":"CVE-2026-21711","evidence":"(CVE-2026-21711)"},{"value":"CVE-2026-21712","evidence":"(CVE-2026-21712)"},{"value":"CVE-2026-21713","evidence":"(CVE-2026-21713)"},{"value":"CVE-2026-21714","evidence":"(CVE-2026-21714)"},{"value":"CVE-2026-21715","evidence":"(CVE-2026-21715)"},{"value":"CVE-2026-21716","evidence":"(CVE-2026-21716)"},{"value":"CVE-2026-21717","evidence":"(CVE-2026-21717)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:efc76334-94e6-45d6-a27d-f4816d1a32a8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v25.8.2","advisory_id":"efc76334-94e6-45d6-a27d-f4816d1a32a8","event_types":["patch"],"published_at":"2026-10-25T03:52:21.858666+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-03-24T20:43:41+00:00","detail_url":"/events/19338"}]}}],"next_after":19478,"next_before":19474}