{"schema_version":"2","view":"grouped","data":[{"id":58878,"cve_ids":["CVE-2017-1000381","CVE-2017-11499"],"payload":{"kind":"patch","title":"Security updates for all active release lines, July 2017","summary":"Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.","evidence":"Updates are now available for all active Node.js release lines as well as the 7.x line.","products":[{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[],"fixed_versions":[{"value":"8.3.0","evidence":"The vulnerability has been patched upstream and snapshots have been re-enabled in 8.3.0"}],"affected_versions":[{"value":"4.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"6.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"7.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"8.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"0.10.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."},{"value":"0.12.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."}]},{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[{"value":"the auth field of the options object used with http.get() to be set to a number","evidence":"Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string."}],"fixed_versions":[],"affected_versions":[{"value":"4.x","evidence":"This is a low severity defect and only applies to the 4.x release line."}]},{"name":{"value":"c-ares","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"all versions of Node.js","evidence":"A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js."}]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2017-11499","evidence":"Constant Hashtable Seeds (CVE-2017-11499)"},{"value":"CVE-2017-1000381","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"}],"security_relevant":true,"severity_evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},"group_id":"advisory:d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2017-security-releases","advisory_id":"d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","event_types":["patch"],"published_at":"2026-10-25T17:37:33.873005+00:00","technologies":["c-ares","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:00:00+00:00","detail_url":"/advisories/advisory%3Ad5d16605-1fc0-4ee5-8f91-90b7c9e84b49","group":{"id":"advisory:d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","revision":1,"primary_event_id":58109,"change":"published","superseded_by":[],"changed":{"id":58109,"cve_ids":["CVE-2017-1000381","CVE-2017-11499"],"payload":{"kind":"patch","title":"Security updates for all active release lines, July 2017","summary":"Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.","evidence":"Updates are now available for all active Node.js release lines as well as the 7.x line.","products":[{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[],"fixed_versions":[{"value":"8.3.0","evidence":"The vulnerability has been patched upstream and snapshots have been re-enabled in 8.3.0"}],"affected_versions":[{"value":"4.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"6.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"7.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"8.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"0.10.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."},{"value":"0.12.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."}]},{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[{"value":"the auth field of the options object used with http.get() to be set to a number","evidence":"Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string."}],"fixed_versions":[],"affected_versions":[{"value":"4.x","evidence":"This is a low severity defect and only applies to the 4.x release line."}]},{"name":{"value":"c-ares","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"all versions of Node.js","evidence":"A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js."}]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2017-11499","evidence":"Constant Hashtable Seeds (CVE-2017-11499)"},{"value":"CVE-2017-1000381","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"}],"security_relevant":true,"severity_evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},"group_id":"advisory:d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2017-security-releases","advisory_id":"d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","event_types":["patch"],"published_at":"2026-10-25T17:37:33.873005+00:00","technologies":["c-ares","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:00:00+00:00","detail_url":"/events/58109"},"members":[{"id":58109,"cve_ids":["CVE-2017-1000381","CVE-2017-11499"],"payload":{"kind":"patch","title":"Security updates for all active release lines, July 2017","summary":"Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.","evidence":"Updates are now available for all active Node.js release lines as well as the 7.x line.","products":[{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[],"fixed_versions":[{"value":"8.3.0","evidence":"The vulnerability has been patched upstream and snapshots have been re-enabled in 8.3.0"}],"affected_versions":[{"value":"4.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"6.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"7.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"8.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"0.10.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."},{"value":"0.12.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."}]},{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[{"value":"the auth field of the options object used with http.get() to be set to a number","evidence":"Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string."}],"fixed_versions":[],"affected_versions":[{"value":"4.x","evidence":"This is a low severity defect and only applies to the 4.x release line."}]},{"name":{"value":"c-ares","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"all versions of Node.js","evidence":"A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js."}]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2017-11499","evidence":"Constant Hashtable Seeds (CVE-2017-11499)"},{"value":"CVE-2017-1000381","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"}],"security_relevant":true,"severity_evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},"group_id":"advisory:d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2017-security-releases","advisory_id":"d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","event_types":["patch"],"published_at":"2026-10-25T17:37:33.873005+00:00","technologies":["c-ares","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-07-11T17:00:00+00:00","detail_url":"/events/58109"}]}}],"next_after":58878,"next_before":58878}