{"schema_version":"1","data":[{"id":54932,"advisory_id":"91dd78bc-768d-46f7-928e-f07460897366","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.14.3","source_published_at":"2018-06-12T23:51:52+00:00","published_at":"2026-10-25T15:27:27.016204+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-7167"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.14.3 (LTS)","summary":"Node.js 6.14.3 fixes a denial-of-service vulnerability involving Buffer.fill() hanging.","evidence":"buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.14.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.14.3","evidence":"Node.js 6.14.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2018-7167","product":"Node.js","evidence":"Node.js 6.14.3 (LTS) Notable Changes buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang"}],"related_cves":[{"value":"CVE-2018-7167","evidence":"buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":54457,"advisory_id":"8bba149b-c064-4af8-81ab-4054a13911a9","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.5.0","source_published_at":"2018-06-20T18:48:28+00:00","published_at":"2026-10-25T15:19:26.762215+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-0732"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.5.0 (Current)","summary":"Node.js 10.5.0 includes an OpenSSL dependency update referencing CVE-2018-0732.","evidence":"[e4a7e0d28b] - deps: float ea7abee from openssl / CVE-2018-0732 (Rod Vagg)","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.5.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"10.5.0","evidence":"Node.js 10.5.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-0732","evidence":"deps: float ea7abee from openssl / CVE-2018-0732"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":52196,"advisory_id":"3f6ad6e2-f900-43f0-9a6d-4c982ef9a01e","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.15.1","source_published_at":"2018-12-03T14:13:12+00:00","published_at":"2026-10-25T14:40:23.492321+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-12122"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.15.1 (LTS)","summary":"Node.js 6.15.1 corrects a backport issue related to the Slowloris HTTP denial-of-service fix. Users of Node.js 6.x LTS 'Boron' are advised to upgrade.","evidence":"This is a patch release to address a bad backport of the fix for \"Slowloris HTTP Denial of Service\" (CVE-2018-12122).","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.15.1","evidence":"Node.js 6.15.1 (LTS)"}],"affected_versions":[{"value":"6.15.0","evidence":"Node.js 6.15.0 misapplies the headers timeout to an entire keep-alive HTTP session"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-12122","evidence":"\"Slowloris HTTP Denial of Service\" (CVE-2018-12122)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":51922,"advisory_id":"688cca60-6c21-4c0c-97d3-9733a8291cca","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.0.0","source_published_at":"2019-04-23T17:01:07+00:00","published_at":"2026-10-25T14:32:00.335389+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-0735"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.0.0 (Current)","summary":"Node.js 12.0.0 includes changes described as hardening validation in Buffer, child_process, and fs, along with updates to bundled dependencies. The announcement does not identify these changes as security fixes or state that a CVE is addressed.","evidence":"Node.js 12.0.0 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.0.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"12.0.0","evidence":"Node.js 12.0.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-0735","evidence":"deps: float 99540ec from openssl (CVE-2018-0735)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":51190,"advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","source_published_at":"2019-02-28T12:47:20+00:00","published_at":"2026-10-25T14:19:53.423486+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50938,"advisory_id":"6094c592-f6d3-476e-9031-4ff22a56c073","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.15.2","source_published_at":"2019-02-28T12:47:33+00:00","published_at":"2026-10-25T14:15:22.088505+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.15.2 (LTS)","summary":"Node.js 10.15.2 addresses a Slowloris HTTP denial-of-service vulnerability by applying the receive timeout consistently to keep-alive connections.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.15.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.15.2","evidence":"Node.js 10.15.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50870,"advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","source_published_at":"2019-02-28T12:47:28+00:00","published_at":"2026-10-25T14:14:02.756652+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50830,"advisory_id":"fc847dd3-7911-45c3-b2c6-e425aebc40b5","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v11.10.1","source_published_at":"2019-02-28T12:47:37+00:00","published_at":"2026-10-25T14:13:25.668282+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 11.10.1 (Current)","summary":"Node.js 11.10.1 includes a fix to prevent Slowloris attacks on HTTP and HTTPS keep-alive connections.","evidence":"A fix for the following CVE is included in this release: Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.10.1","evidence":"Node.js 11.10.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50634,"advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","source_published_at":"2019-02-28T12:53:26+00:00","published_at":"2026-10-25T14:10:27.337042+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"event_types":["patch"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":48592,"advisory_id":"4a3ac421-72e4-485c-b111-1389f69c623b","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.8.1","source_published_at":"2019-08-15T13:15:32+00:00","published_at":"2026-10-25T13:35:27.668732+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-9511","CVE-2019-9512","CVE-2019-9513","CVE-2019-9514","CVE-2019-9515","CVE-2019-9516","CVE-2019-9517","CVE-2019-9518"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.8.1 (Current)","summary":"Node.js 12.8.1 is a security release addressing HTTP/2 denial-of-service vulnerabilities.","evidence":"This is a security release. Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks.","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.8.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"12.8.1","evidence":"Node.js 12.8.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-9511","evidence":"CVE-2019-9511 “Data Dribble”"},{"value":"CVE-2019-9512","evidence":"CVE-2019-9512 “Ping Flood”"},{"value":"CVE-2019-9513","evidence":"CVE-2019-9513 “Resource Loop”"},{"value":"CVE-2019-9514","evidence":"CVE-2019-9514 “Reset Flood”"},{"value":"CVE-2019-9515","evidence":"CVE-2019-9515 “Settings Flood”"},{"value":"CVE-2019-9516","evidence":"CVE-2019-9516 “0-Length Headers Leak”"},{"value":"CVE-2019-9517","evidence":"CVE-2019-9517 “Internal Data Buffering”"},{"value":"CVE-2019-9518","evidence":"CVE-2019-9518 “Empty Frames Flood”"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":48505,"advisory_id":"5f187f3d-90c2-4258-8078-366f25e63a7c","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.16.1","source_published_at":"2019-08-15T22:38:49+00:00","published_at":"2026-10-25T13:34:23.669722+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-9511","CVE-2019-9512","CVE-2019-9513","CVE-2019-9514","CVE-2019-9515","CVE-2019-9516","CVE-2019-9517","CVE-2019-9518"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 8.16.1 (LTS)","summary":"Node.js 8.16.1 (LTS) is a security release addressing HTTP/2 denial-of-service vulnerabilities.","evidence":"This is a security release. Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.16.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.16.1","evidence":"Node.js 8.16.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-9511","evidence":"CVE-2019-9511 “Data Dribble”"},{"value":"CVE-2019-9512","evidence":"CVE-2019-9512 “Ping Flood”"},{"value":"CVE-2019-9513","evidence":"CVE-2019-9513 “Resource Loop”"},{"value":"CVE-2019-9514","evidence":"CVE-2019-9514 “Reset Flood”"},{"value":"CVE-2019-9515","evidence":"CVE-2019-9515 “Settings Flood”"},{"value":"CVE-2019-9516","evidence":"CVE-2019-9516 “0-Length Headers Leak”"},{"value":"CVE-2019-9517","evidence":"CVE-2019-9517 “Internal Data Buffering”"},{"value":"CVE-2019-9518","evidence":"CVE-2019-9518 “Empty Frames Flood”"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":48410,"advisory_id":"ead1ad8c-7cac-4ad6-b1a7-d4c6da1fb550","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.16.3","source_published_at":"2019-08-15T22:41:03+00:00","published_at":"2026-10-25T13:32:32.871656+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-9511","CVE-2019-9512","CVE-2019-9513","CVE-2019-9514","CVE-2019-9515","CVE-2019-9516","CVE-2019-9517","CVE-2019-9518"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.16.3 (LTS)","summary":"Node.js 10.16.3 is a security release addressing HTTP/2 denial-of-service vulnerabilities.","evidence":"This is a security release. Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks.","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.16.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.16.3","evidence":"Node.js 10.16.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-9511","evidence":"CVE-2019-9511 “Data Dribble”"},{"value":"CVE-2019-9512","evidence":"CVE-2019-9512 “Ping Flood”"},{"value":"CVE-2019-9513","evidence":"CVE-2019-9513 “Resource Loop”"},{"value":"CVE-2019-9514","evidence":"CVE-2019-9514 “Reset Flood”"},{"value":"CVE-2019-9515","evidence":"CVE-2019-9515 “Settings Flood”"},{"value":"CVE-2019-9516","evidence":"CVE-2019-9516 “0-Length Headers Leak”"},{"value":"CVE-2019-9517","evidence":"CVE-2019-9517 “Internal Data Buffering”"},{"value":"CVE-2019-9518","evidence":"CVE-2019-9518 “Empty Frames Flood”"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":48097,"advisory_id":"433221a7-925a-44db-a1b9-7737a4360664","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/september-2019-openssl-updates","source_published_at":"2019-09-05T15:34:35+00:00","published_at":"2026-10-25T13:27:30.753402+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":[],"event_types":["advisory"],"payload":{"kind":"advisory","title":"OpenSSL security releases may require Node.js security releases","summary":"OpenSSL planned security releases affecting versions used by Node.js active release lines. The Node.js project had not yet determined whether immediate Node.js security releases were needed.","evidence":"The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"v8.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v10.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v12.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."}]},{"name":{"value":"OpenSSL","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2t","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},{"value":"1.1.1d","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."}],"affected_versions":[]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":47367,"advisory_id":"7323ea26-9cb5-44d9-aef8-f2d0f6a79901","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.13.1","source_published_at":"2019-11-19T10:53:56+00:00","published_at":"2026-10-25T13:15:21.845817+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.13.1 (LTS)","summary":"Node.js 12.13.1 includes a crypto change to reject public keys properly.","evidence":"[e175d0beb6] - crypto: reject public keys properly (Tobias Nießen) #29913","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.13.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.13.1","evidence":"Node.js 12.13.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":47088,"advisory_id":"92f2418d-34aa-489d-b443-ac98346d0d39","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2019-security-releases","source_published_at":"2019-12-18T00:23:00+00:00","published_at":"2026-10-25T13:09:24.794163+00:00","extraction_method":"llm","technologies":["node-js","nodejs","npm-cli"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"December 2019 Security Releases","summary":"Node.js security releases update npm to address vulnerabilities involving global binary overwrites, symlinks outside node_modules, and arbitrary file writes. The announcement says all current release lines were affected.","evidence":"These releases update npm to v6.13.4 to address three vulnerabilities described below. All current release lines were affected.","products":[{"name":{"value":"npm CLI","evidence":"Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite."},"prerequisites":[],"fixed_versions":[{"value":"v6.13.4","evidence":"These releases update npm to v6.13.4 to address three vulnerabilities described below."}],"affected_versions":[{"value":"prior to 6.13.4","evidence":"Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite."},{"value":"prior to 6.13.3","evidence":"Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules."}]},{"name":{"value":"Node.js","evidence":"All versions of Node.js are vulnerable including the LTS and current releases:"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v13.4.0","evidence":"Node.js v13.4.0"},{"value":"Node.js v12.14.0","evidence":"Node.js v12.14.0"},{"value":"Node.js v10.18.0","evidence":"Node.js v10.18.0"},{"value":"Node.js v8.17.0","evidence":"Node.js v8.17.0"}],"affected_versions":[{"value":"Node.js 8","evidence":"Node.js 8 (LTS \"Carbon\"), Node.js 10 (LTS \"Dubnium\") , Node.js 12 (LTS \"Erbium\"), and Node.js 13."},{"value":"Node.js 10","evidence":"Node.js 8 (LTS \"Carbon\"), Node.js 10 (LTS \"Dubnium\") , Node.js 12 (LTS \"Erbium\"), and Node.js 13."},{"value":"Node.js 12","evidence":"Node.js 8 (LTS \"Carbon\"), Node.js 10 (LTS \"Dubnium\") , Node.js 12 (LTS \"Erbium\"), and Node.js 13."},{"value":"Node.js 13","evidence":"Node.js 8 (LTS \"Carbon\"), Node.js 10 (LTS \"Dubnium\") , Node.js 12 (LTS \"Erbium\"), and Node.js 13."}]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":46730,"advisory_id":"78f963a5-1bf1-44fc-a22d-d3b862983eb2","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.15.0","source_published_at":"2020-02-06T03:13:05+00:00","published_at":"2026-10-25T13:02:22.827249+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-15604","CVE-2019-15605","CVE-2019-15606"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.15.0 (LTS)","summary":"Node.js 12.15.0 (LTS) is a security release that fixes three vulnerabilities and makes HTTP parsing stricter.","evidence":"This is a security release. Vulnerabilities fixed: CVE-2019-15606: HTTP header values do not have trailing OWS trimmed. CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header. CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.15.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.15.0","evidence":"Node.js 12.15.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-15606","evidence":"CVE-2019-15606: HTTP header values do not have trailing OWS trimmed."},{"value":"CVE-2019-15605","evidence":"CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header."},{"value":"CVE-2019-15604","evidence":"CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":46729,"advisory_id":"e9ba7781-2fa4-4635-9054-1ecdb6e7f128","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.19.0","source_published_at":"2020-02-06T03:11:18+00:00","published_at":"2026-10-25T13:01:43.301303+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-15604","CVE-2019-15605","CVE-2019-15606"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.19.0 (LTS)","summary":"Node.js 10.19.0 is a security release fixing three vulnerabilities and tightening HTTP parsing. The release notes warn that the insecure HTTP parser should be avoided.","evidence":"This is a security release. Vulnerabilities fixed:","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.19.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.19.0","evidence":"Node.js 10.19.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-15606","evidence":"CVE-2019-15606: HTTP header values do not have trailing OWS trimmed."},{"value":"CVE-2019-15605","evidence":"CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header."},{"value":"CVE-2019-15604","evidence":"CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":46704,"advisory_id":"e7b3e187-cc7b-4500-b9d5-c840c9974006","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v13.8.0","source_published_at":"2020-02-06T11:38:12+00:00","published_at":"2026-10-25T13:01:22.385711+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-15604","CVE-2019-15605","CVE-2019-15606"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 13.8.0 (Current)","summary":"Node.js 13.8.0 is a security release fixing three listed vulnerabilities and tightening HTTP parsing; the release notes describe an option to disable strict checks but advise against using it.","evidence":"This is a security release. Vulnerabilities fixed:","products":[{"name":{"value":"Node.js","evidence":"Node.js 13.8.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"13.8.0","evidence":"Node.js 13.8.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-15606","evidence":"CVE-2019-15606: HTTP header values do not have trailing OWS trimmed."},{"value":"CVE-2019-15605","evidence":"CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header."},{"value":"CVE-2019-15604","evidence":"CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":46500,"advisory_id":"609fa9a9-271c-47c7-8caf-2e3f4287d471","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2020-security-releases","source_published_at":"2020-02-06T12:00:00+00:00","published_at":"2026-10-25T12:57:26.794061+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-15604","CVE-2019-15605","CVE-2019-15606"],"event_types":["patch"],"payload":{"kind":"patch","title":"February 2020 Security Releases","summary":"Node.js released security updates for all active release lines, addressing HTTP request smuggling, HTTP header whitespace handling, and a TLS server crash, along with stricter HTTP parsing.","evidence":"Updates are now available for all active Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.19.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v10.19.0 (LTS)","evidence":"Node.js v10.19.0 (LTS)"},{"value":"Node.js v12.15.0 (LTS)","evidence":"Node.js v12.15.0 (LTS)"},{"value":"Node.js v13.8.0 (Current)","evidence":"Node.js v13.8.0 (Current)"}],"affected_versions":[{"value":"10.x","evidence":"All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable."},{"value":"12.x","evidence":"All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable."},{"value":"13.x","evidence":"All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-15605","evidence":"HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)"},{"value":"CVE-2019-15606","evidence":"HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606)"},{"value":"CVE-2019-15604","evidence":"Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":46226,"advisory_id":"3387f953-0fb4-4cc9-a149-b3293817c668","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/april-2020-openssl-updates","source_published_at":"2020-04-21T12:00:00+00:00","published_at":"2026-10-25T12:46:54.259769+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["other"],"payload":{"kind":"other","title":"OpenSSL security releases do not require Node.js security releases","summary":"The OpenSSL 1.1.1g issue does not affect Node.js because the affected function is not called by Node.js or its dependencies; no Node.js security releases are required.","evidence":"It only affects a function which is not called by Node.js (or its dependencies), and as such, does not affect Node.js. No Node.js security releases are required.","products":[{"name":{"value":"Node.js","evidence":"does not affect Node.js"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":45589,"advisory_id":"3707a798-8371-4552-80fd-62b229358149","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases","source_published_at":"2020-06-02T12:00:00+00:00","published_at":"2026-10-25T12:35:26.165873+00:00","extraction_method":"llm","technologies":["node-addon-api","node-js","nodejs"],"cve_ids":["CVE-2020-10531","CVE-2020-11080","CVE-2020-8172","CVE-2020-8174"],"event_types":["patch"],"payload":{"kind":"patch","title":"June 2020 Security Releases","summary":"Node.js released security updates for supported release lines addressing TLS session reuse, HTTP/2 settings-frame denial of service, N-API string-buffer memory corruption, and an ICU issue. Node.js 10.21.0, 12.18.0, and 14.4.0 are the listed releases.","evidence":"Updates are now available for all supported Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.21.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.21.0","evidence":"Node.js v10.21.0 (LTS)"},{"value":"12.18.0","evidence":"Node.js v12.18.0 (LTS)"},{"value":"14.4.0","evidence":"Node.js v14.4.0 (Current)"}],"affected_versions":[{"value":"10.x","evidence":"Affects Node.js 10.x, 12.x, and 14.x."},{"value":"12.x","evidence":"Affects Node.js 12.x, and 14.x."},{"value":"14.x","evidence":"Affects Node.js 12.x, and 14.x."}]},{"name":{"value":"node-addon-api","evidence":"https://www.npmjs.com/package/node-addon-api"},"prerequisites":[{"value":"when a native add-on is/was built using a version of Node.js that did not support N-API internally","evidence":"Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally."}],"fixed_versions":[],"affected_versions":[{"value":"1.x","evidence":"Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally."},{"value":"2.x","evidence":"Affects https://www.npmjs.com/package/node-addon-api 1.x, 2.x when a native add-on is/was built using a version of Node.js that did not support N-API internally."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8172","evidence":"TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172)"},{"value":"CVE-2020-11080","evidence":"HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080)"},{"value":"CVE-2020-8174","evidence":"napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174)"},{"value":"CVE-2020-10531","evidence":"ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":45588,"advisory_id":"20110e09-68fd-47a4-a330-640cacfa57ef","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.4.0","source_published_at":"2020-06-02T18:41:48+00:00","published_at":"2026-10-25T12:35:23.844116+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-11080","CVE-2020-8172","CVE-2020-8174"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.4.0 (Current)","summary":"Node.js 14.4.0 is a security release fixing TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption vulnerabilities.","evidence":"This is a security release. Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.4.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"14.4.0","evidence":"Node.js 14.4.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8172","evidence":"CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass"},{"value":"CVE-2020-11080","evidence":"CVE-2020-11080: HTTP/2 Large Settings Frame DoS"},{"value":"CVE-2020-8174","evidence":"CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":45501,"advisory_id":"2f172ae9-e77a-40a4-8462-db1d7eb9252c","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.18.0","source_published_at":"2020-06-02T18:41:58+00:00","published_at":"2026-10-25T12:34:22.842516+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-11080","CVE-2020-8172","CVE-2020-8174"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.18.0 (LTS)","summary":"Node.js 12.18.0 (LTS) is a security release that fixes three vulnerabilities, including TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption issues.","evidence":"This is a security release. Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.18.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.18.0","evidence":"Node.js 12.18.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8172","evidence":"CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High)."},{"value":"CVE-2020-11080","evidence":"CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low)."},{"value":"CVE-2020-8174","evidence":"CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High)."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":45406,"advisory_id":"5453abc0-2362-4419-9e2f-a3b64df09adf","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.21.0","source_published_at":"2020-06-02T18:50:23+00:00","published_at":"2026-10-25T12:32:27.993663+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-10531","CVE-2020-11080","CVE-2020-8174"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.21.0 (LTS)","summary":"Node.js 10.21.0 (LTS) is a security release fixing vulnerabilities in N-API, ICU, and HTTP/2.","evidence":"This is a security release. Vulnerabilities fixed:","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.21.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.21.0","evidence":"Node.js 10.21.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8174","evidence":"CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High)."},{"value":"CVE-2020-10531","evidence":"CVE-2020-10531: ICU-20958 Prevent SEGV_MAPERR in append (High)."},{"value":"CVE-2020-11080","evidence":"CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low)."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":44169,"advisory_id":"832ea194-26c8-46c2-a933-4be6158dc2e8","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.11.0","source_published_at":"2020-09-15T21:05:57+00:00","published_at":"2026-10-25T12:12:22.912891+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-8201","CVE-2020-8251"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.11.0 (Current)","summary":"Node.js 14.11.0 is a security release fixing two vulnerabilities: denial of service from unfinished HTTP/1.1 requests and HTTP request smuggling.","evidence":"This is a security release. Vulnerabilities fixed: CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical). CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion (High).","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.11.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"14.11.0","evidence":"Node.js 14.11.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8251","evidence":"CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical)."},{"value":"CVE-2020-8201","evidence":"CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion (High)."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":44049,"advisory_id":"806af4df-e311-4174-946f-e5447cd87801","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.18.4","source_published_at":"2020-09-15T21:06:31+00:00","published_at":"2026-10-25T12:10:21.989923+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-8201","CVE-2020-8252"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.18.4 (LTS)","summary":"Node.js 12.18.4 is a security release fixing two vulnerabilities.","evidence":"This is a security release. Vulnerabilities fixed:","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.18.4 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.18.4","evidence":"Node.js 12.18.4 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8201","evidence":"CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion (High)."},{"value":"CVE-2020-8252","evidence":"CVE-2020-8252: fs.realpath.native on may cause buffer overflow (Medium)."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":42815,"advisory_id":"2de797bd-4697-4849-9e39-996ebbcc08ad","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/november-2020-security-releases","source_published_at":"2020-11-16T16:00:00+00:00","published_at":"2026-10-25T11:49:47.140272+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-8277"],"event_types":["patch"],"payload":{"kind":"patch","title":"November 2020 Security Releases","summary":"Node.js security updates address a denial-of-service issue involving DNS requests.","evidence":"Security releases available Updates are now available for v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v12.19.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v12.19.1 (LTS)","evidence":"Downloads and release details Node.js v12.19.1 (LTS)"},{"value":"Node.js v14.15.1 (LTS)","evidence":"Node.js v14.15.1 (LTS)"},{"value":"Node.js v15.2.1 (Current)","evidence":"Node.js v15.2.1 (Current)"}],"affected_versions":[{"value":"Versions 12.16.3 and higher on the 12.x release line","evidence":"Impacts: Versions 12.16.3 and higher on the 12.x release line"},{"value":"Versions 14.13.0 and higher on the 14.x release line","evidence":"Versions 14.13.0 and higher on the 14.x release line"},{"value":"All versions of the 15.x release line","evidence":"All versions of the 15.x release line"}]}],"severity":"high","related_cves":[{"value":"CVE-2020-8277","evidence":"Denial of Service through DNS request (CVE-2020-8277)"}],"security_relevant":true,"severity_evidence":"These releases will fix: One high severity issue"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":41953,"advisory_id":"e5731f12-c86e-4184-bace-38030f9f4065","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.22.1","source_published_at":"2021-04-06T20:09:43+00:00","published_at":"2026-10-25T11:37:22.729674+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-7774","CVE-2021-3449","CVE-2021-3450"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.22.1 (LTS)","summary":"Node.js 12.22.1 includes fixes for OpenSSL and npm-related vulnerabilities.","evidence":"Vulnerabilities fixed: CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.22.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.22.1","evidence":"Node.js 12.22.1 (LTS)"}],"affected_versions":[{"value":"12.x","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3450","evidence":"CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT"},{"value":"CVE-2021-3449","evidence":"CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing"},{"value":"CVE-2020-7774","evidence":"CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":41729,"advisory_id":"21f0fcf8-48ea-4447-8e76-f1c94227486e","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v14.15.4","source_published_at":"2021-01-04T18:17:46+00:00","published_at":"2026-10-25T11:24:23.597488+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-1971","CVE-2020-8265","CVE-2020-8287"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 14.15.4 (LTS)","summary":"Node.js 14.15.4 (LTS) fixes three listed vulnerabilities involving OpenSSL, TLSWrap, and HTTP request smuggling.","evidence":"Vulnerabilities fixed: CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)","products":[{"name":{"value":"Node.js","evidence":"Node.js 14.15.4 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"14.15.4","evidence":"Node.js 14.15.4 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-1971","evidence":"CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)"},{"value":"CVE-2020-8265","evidence":"CVE-2020-8265: use-after-free in TLSWrap (High)"},{"value":"CVE-2020-8287","evidence":"CVE-2020-8287: HTTP Request Smuggling in nodejs (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":41631,"advisory_id":"21e3ba6b-4da3-4f58-b8e4-52309cbccc8b","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v15.5.1","source_published_at":"2021-01-04T18:15:24+00:00","published_at":"2026-10-25T11:22:41.990272+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2020-8265","CVE-2020-8287"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 15.5.1 (Current)","summary":"Node.js 15.5.1 fixes a TLS use-after-free vulnerability and HTTP request smuggling caused by duplicate request headers.","evidence":"Vulnerabilities fixed: CVE-2020-8265: use-after-free in TLSWrap (High)","products":[{"name":{"value":"Node.js","evidence":"Node.js 15.5.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"15.5.1","evidence":"Node.js 15.5.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8265","evidence":"CVE-2020-8265: use-after-free in TLSWrap (High)"},{"value":"CVE-2020-8287","evidence":"CVE-2020-8287: HTTP Request Smuggling in nodejs (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":54932,"next_before":41631}