{"schema_version":"2","view":"grouped","data":[{"id":19480,"cve_ids":["CVE-2025-11187","CVE-2025-69421","CVE-2026-22795"],"payload":{"kind":"advisory","title":"OpenSSL Security Advisory Assessment, January 2026","summary":"The Node.js Project reports that three OpenSSL vulnerabilities affect Node.js branches through PFX certificate processing. The issues require a specially crafted PFX file; updates are planned for upcoming regular Node.js releases.","evidence":"The OpenSSL project released a security advisory that includes 12 CVEs. After assessment, we have concluded that three CVEs affect Node.js (severity Low to Moderate).","products":[{"name":{"value":"Node.js","evidence":"three CVEs affect Node.js"},"prerequisites":[{"value":"An attacker would need to provide a specially crafted PFX file","evidence":"An attacker would need to provide a specially crafted PFX file to trigger any of these issues."}],"fixed_versions":[],"affected_versions":[{"value":"v20.x","evidence":"v20.x 3.0.15 Yes"},{"value":"v22.x","evidence":"v22.x 3.5.4 Yes"},{"value":"v24.x","evidence":"v24.x 3.5.4 Yes"},{"value":"v25.x","evidence":"v25.x 3.5.4 Yes"},{"value":"main","evidence":"main 3.5.4 Yes"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-11187","evidence":"CVE-2025-11187: Stack buffer overflow in PBMAC1 MAC verification - Moderate"},{"value":"CVE-2025-69421","evidence":"CVE-2025-69421: NULL pointer dereference in PKCS12_item_decrypt_d2i_ex() - Low"},{"value":"CVE-2026-22795","evidence":"CVE-2026-22795: Type confusion during PKCS#12 parsing - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0be082cb-7169-4fb3-a168-87ece79bc0da","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-jan2026","advisory_id":"0be082cb-7169-4fb3-a168-87ece79bc0da","event_types":["advisory"],"published_at":"2026-10-25T04:09:23.016215+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-28T17:00:00+00:00","detail_url":"/advisories/advisory%3A0be082cb-7169-4fb3-a168-87ece79bc0da","group":{"id":"advisory:0be082cb-7169-4fb3-a168-87ece79bc0da","revision":1,"primary_event_id":19344,"change":"published","superseded_by":[],"changed":{"id":19344,"cve_ids":["CVE-2025-11187","CVE-2025-69421","CVE-2026-22795"],"payload":{"kind":"advisory","title":"OpenSSL Security Advisory Assessment, January 2026","summary":"The Node.js Project reports that three OpenSSL vulnerabilities affect Node.js branches through PFX certificate processing. The issues require a specially crafted PFX file; updates are planned for upcoming regular Node.js releases.","evidence":"The OpenSSL project released a security advisory that includes 12 CVEs. After assessment, we have concluded that three CVEs affect Node.js (severity Low to Moderate).","products":[{"name":{"value":"Node.js","evidence":"three CVEs affect Node.js"},"prerequisites":[{"value":"An attacker would need to provide a specially crafted PFX file","evidence":"An attacker would need to provide a specially crafted PFX file to trigger any of these issues."}],"fixed_versions":[],"affected_versions":[{"value":"v20.x","evidence":"v20.x 3.0.15 Yes"},{"value":"v22.x","evidence":"v22.x 3.5.4 Yes"},{"value":"v24.x","evidence":"v24.x 3.5.4 Yes"},{"value":"v25.x","evidence":"v25.x 3.5.4 Yes"},{"value":"main","evidence":"main 3.5.4 Yes"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-11187","evidence":"CVE-2025-11187: Stack buffer overflow in PBMAC1 MAC verification - Moderate"},{"value":"CVE-2025-69421","evidence":"CVE-2025-69421: NULL pointer dereference in PKCS12_item_decrypt_d2i_ex() - Low"},{"value":"CVE-2026-22795","evidence":"CVE-2026-22795: Type confusion during PKCS#12 parsing - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0be082cb-7169-4fb3-a168-87ece79bc0da","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-jan2026","advisory_id":"0be082cb-7169-4fb3-a168-87ece79bc0da","event_types":["advisory"],"published_at":"2026-10-25T04:09:23.016215+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-28T17:00:00+00:00","detail_url":"/events/19344"},"members":[{"id":19344,"cve_ids":["CVE-2025-11187","CVE-2025-69421","CVE-2026-22795"],"payload":{"kind":"advisory","title":"OpenSSL Security Advisory Assessment, January 2026","summary":"The Node.js Project reports that three OpenSSL vulnerabilities affect Node.js branches through PFX certificate processing. The issues require a specially crafted PFX file; updates are planned for upcoming regular Node.js releases.","evidence":"The OpenSSL project released a security advisory that includes 12 CVEs. After assessment, we have concluded that three CVEs affect Node.js (severity Low to Moderate).","products":[{"name":{"value":"Node.js","evidence":"three CVEs affect Node.js"},"prerequisites":[{"value":"An attacker would need to provide a specially crafted PFX file","evidence":"An attacker would need to provide a specially crafted PFX file to trigger any of these issues."}],"fixed_versions":[],"affected_versions":[{"value":"v20.x","evidence":"v20.x 3.0.15 Yes"},{"value":"v22.x","evidence":"v22.x 3.5.4 Yes"},{"value":"v24.x","evidence":"v24.x 3.5.4 Yes"},{"value":"v25.x","evidence":"v25.x 3.5.4 Yes"},{"value":"main","evidence":"main 3.5.4 Yes"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-11187","evidence":"CVE-2025-11187: Stack buffer overflow in PBMAC1 MAC verification - Moderate"},{"value":"CVE-2025-69421","evidence":"CVE-2025-69421: NULL pointer dereference in PKCS12_item_decrypt_d2i_ex() - Low"},{"value":"CVE-2026-22795","evidence":"CVE-2026-22795: Type confusion during PKCS#12 parsing - Low"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0be082cb-7169-4fb3-a168-87ece79bc0da","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-jan2026","advisory_id":"0be082cb-7169-4fb3-a168-87ece79bc0da","event_types":["advisory"],"published_at":"2026-10-25T04:09:23.016215+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-28T17:00:00+00:00","detail_url":"/events/19344"}]}}],"next_after":19480,"next_before":19480}