{"schema_version":"2","view":"grouped","data":[{"id":69319,"cve_ids":["CVE-2015-3197","CVE-2016-0701"],"payload":{"kind":"advisory","title":"OpenSSL upgrade low-severity Node.js security fixes","summary":"Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.","evidence":"The Node.js project will be releasing new versions across all of its active release lines early next week (possibly sooner, pending full impact assessment) to incorporate upstream patches from OpenSSL and some additional low-severity fixes relating to HTTP handling.","products":[{"name":{"value":"Node.js","evidence":"Versions 0.10.x of Node.js are affected."},"prerequisites":[{"value":"unless the --enable-ssl2 command line argument is being used (not recommended).","evidence":"Node.js v0.10 and v0.12 disable SSLv2 by default and are not affected unless the --enable-ssl2 command line argument is being used (not recommended)."}],"fixed_versions":[],"affected_versions":[{"value":"0.10.x","evidence":"Versions 0.10.x of Node.js are affected."},{"value":"0.12.x","evidence":"Versions 0.12.x of Node.js are affected."},{"value":"4.x","evidence":"Versions 4.x, including LTS Argon, of Node.js are affected."},{"value":"5.x","evidence":"Versions 5.x of Node.js are affected."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0701","evidence":"DH small subgroups (CVE-2016-0701)"},{"value":"CVE-2015-3197","evidence":"SSLv2 doesn't block disabled ciphers (CVE-2015-3197)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d6fcf49e-5589-4505-a24a-e46bca0d35c9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-and-low-severity-fixes-jan-2016","advisory_id":"d6fcf49e-5589-4505-a24a-e46bca0d35c9","event_types":["advisory"],"published_at":"2026-10-25T21:56:26.373403+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-01-27T11:34:41+00:00","detail_url":"/advisories/advisory%3Ad6fcf49e-5589-4505-a24a-e46bca0d35c9","group":{"id":"advisory:d6fcf49e-5589-4505-a24a-e46bca0d35c9","revision":1,"primary_event_id":69689,"change":"published","superseded_by":[],"changed":{"id":69689,"cve_ids":["CVE-2015-3197","CVE-2016-0701"],"payload":{"kind":"advisory","title":"OpenSSL upgrade low-severity Node.js security fixes","summary":"Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.","evidence":"The Node.js project will be releasing new versions across all of its active release lines early next week (possibly sooner, pending full impact assessment) to incorporate upstream patches from OpenSSL and some additional low-severity fixes relating to HTTP handling.","products":[{"name":{"value":"Node.js","evidence":"Versions 0.10.x of Node.js are affected."},"prerequisites":[{"value":"unless the --enable-ssl2 command line argument is being used (not recommended).","evidence":"Node.js v0.10 and v0.12 disable SSLv2 by default and are not affected unless the --enable-ssl2 command line argument is being used (not recommended)."}],"fixed_versions":[],"affected_versions":[{"value":"0.10.x","evidence":"Versions 0.10.x of Node.js are affected."},{"value":"0.12.x","evidence":"Versions 0.12.x of Node.js are affected."},{"value":"4.x","evidence":"Versions 4.x, including LTS Argon, of Node.js are affected."},{"value":"5.x","evidence":"Versions 5.x of Node.js are affected."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0701","evidence":"DH small subgroups (CVE-2016-0701)"},{"value":"CVE-2015-3197","evidence":"SSLv2 doesn't block disabled ciphers (CVE-2015-3197)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d6fcf49e-5589-4505-a24a-e46bca0d35c9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-and-low-severity-fixes-jan-2016","advisory_id":"d6fcf49e-5589-4505-a24a-e46bca0d35c9","event_types":["advisory"],"published_at":"2026-10-25T21:56:26.373403+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-01-27T11:34:41+00:00","detail_url":"/events/69689"},"members":[{"id":69689,"cve_ids":["CVE-2015-3197","CVE-2016-0701"],"payload":{"kind":"advisory","title":"OpenSSL upgrade low-severity Node.js security fixes","summary":"Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.","evidence":"The Node.js project will be releasing new versions across all of its active release lines early next week (possibly sooner, pending full impact assessment) to incorporate upstream patches from OpenSSL and some additional low-severity fixes relating to HTTP handling.","products":[{"name":{"value":"Node.js","evidence":"Versions 0.10.x of Node.js are affected."},"prerequisites":[{"value":"unless the --enable-ssl2 command line argument is being used (not recommended).","evidence":"Node.js v0.10 and v0.12 disable SSLv2 by default and are not affected unless the --enable-ssl2 command line argument is being used (not recommended)."}],"fixed_versions":[],"affected_versions":[{"value":"0.10.x","evidence":"Versions 0.10.x of Node.js are affected."},{"value":"0.12.x","evidence":"Versions 0.12.x of Node.js are affected."},{"value":"4.x","evidence":"Versions 4.x, including LTS Argon, of Node.js are affected."},{"value":"5.x","evidence":"Versions 5.x of Node.js are affected."}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0701","evidence":"DH small subgroups (CVE-2016-0701)"},{"value":"CVE-2015-3197","evidence":"SSLv2 doesn't block disabled ciphers (CVE-2015-3197)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d6fcf49e-5589-4505-a24a-e46bca0d35c9","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-and-low-severity-fixes-jan-2016","advisory_id":"d6fcf49e-5589-4505-a24a-e46bca0d35c9","event_types":["advisory"],"published_at":"2026-10-25T21:56:26.373403+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-01-27T11:34:41+00:00","detail_url":"/events/69689"}]}},{"id":68529,"cve_ids":["CVE-2016-2086","CVE-2016-2216"],"payload":{"kind":"patch","title":"Node.js 4.3.0 (LTS)","summary":"Node.js 4.3.0 is an important security release. It changes HTTP header parsing to address request smuggling and response splitting, and updates OpenSSL and http-parser.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.3.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.3.0","evidence":"Node.js 4.3.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2016-2086","product":"Node.js","evidence":"Node.js 4.3.0 (LTS) This is an important security release. For full details see /blog/vulnerability/february-2016-security-releases/ for details on patched vulnerabilities. Notable changes http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086)"},{"cve":"CVE-2016-2216","product":"Node.js","evidence":"Node.js 4.3.0 (LTS) This is an important security release. For full details see /blog/vulnerability/february-2016-security-releases/ for details on patched vulnerabilities. Notable changes http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086) or response splitting (CVE-2016-2216)."}],"related_cves":[{"value":"CVE-2016-2086","evidence":"that can allow request smuggling (CVE-2016-2086)"},{"value":"CVE-2016-2216","evidence":"or response splitting (CVE-2016-2216)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cd58b48c-fb28-4624-af35-d824a6a712c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.3.0","advisory_id":"cd58b48c-fb28-4624-af35-d824a6a712c5","event_types":["patch"],"published_at":"2026-10-25T21:42:23.853036+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-02-09T17:32:54+00:00","detail_url":"/advisories/advisory%3Acd58b48c-fb28-4624-af35-d824a6a712c5","group":{"id":"advisory:cd58b48c-fb28-4624-af35-d824a6a712c5","revision":1,"primary_event_id":68899,"change":"published","superseded_by":[],"changed":{"id":68899,"cve_ids":["CVE-2016-2086","CVE-2016-2216"],"payload":{"kind":"patch","title":"Node.js 4.3.0 (LTS)","summary":"Node.js 4.3.0 is an important security release. It changes HTTP header parsing to address request smuggling and response splitting, and updates OpenSSL and http-parser.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.3.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.3.0","evidence":"Node.js 4.3.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2016-2086","product":"Node.js","evidence":"Node.js 4.3.0 (LTS) This is an important security release. For full details see /blog/vulnerability/february-2016-security-releases/ for details on patched vulnerabilities. Notable changes http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086)"},{"cve":"CVE-2016-2216","product":"Node.js","evidence":"Node.js 4.3.0 (LTS) This is an important security release. For full details see /blog/vulnerability/february-2016-security-releases/ for details on patched vulnerabilities. Notable changes http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086) or response splitting (CVE-2016-2216)."}],"related_cves":[{"value":"CVE-2016-2086","evidence":"that can allow request smuggling (CVE-2016-2086)"},{"value":"CVE-2016-2216","evidence":"or response splitting (CVE-2016-2216)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cd58b48c-fb28-4624-af35-d824a6a712c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.3.0","advisory_id":"cd58b48c-fb28-4624-af35-d824a6a712c5","event_types":["patch"],"published_at":"2026-10-25T21:42:23.853036+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-02-09T17:32:54+00:00","detail_url":"/events/68899"},"members":[{"id":68899,"cve_ids":["CVE-2016-2086","CVE-2016-2216"],"payload":{"kind":"patch","title":"Node.js 4.3.0 (LTS)","summary":"Node.js 4.3.0 is an important security release. It changes HTTP header parsing to address request smuggling and response splitting, and updates OpenSSL and http-parser.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.3.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.3.0","evidence":"Node.js 4.3.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2016-2086","product":"Node.js","evidence":"Node.js 4.3.0 (LTS) This is an important security release. For full details see /blog/vulnerability/february-2016-security-releases/ for details on patched vulnerabilities. Notable changes http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086)"},{"cve":"CVE-2016-2216","product":"Node.js","evidence":"Node.js 4.3.0 (LTS) This is an important security release. For full details see /blog/vulnerability/february-2016-security-releases/ for details on patched vulnerabilities. Notable changes http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086) or response splitting (CVE-2016-2216)."}],"related_cves":[{"value":"CVE-2016-2086","evidence":"that can allow request smuggling (CVE-2016-2086)"},{"value":"CVE-2016-2216","evidence":"or response splitting (CVE-2016-2216)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cd58b48c-fb28-4624-af35-d824a6a712c5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.3.0","advisory_id":"cd58b48c-fb28-4624-af35-d824a6a712c5","event_types":["patch"],"published_at":"2026-10-25T21:42:23.853036+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-02-09T17:32:54+00:00","detail_url":"/events/68899"}]}},{"id":67821,"cve_ids":[],"payload":{"kind":"patch","title":"February 2016 Security Release Summary","summary":"Node.js released security updates for four release lines, including fixes for announced vulnerabilities and OpenSSL updates. The v4.2.x line is no longer updated; users are advised to upgrade.","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v0.10.42 and v0.12.10 upgrade the bundled version of OpenSSL from 1.0.1q to 1.0.1r."},"prerequisites":[],"fixed_versions":[{"value":"v0.10.42","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v0.12.10","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v4.3.0","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v5.6.0","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:48226981-6425-44b0-ad5d-e6318d96173f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2016-02-15","advisory_id":"48226981-6425-44b0-ad5d-e6318d96173f","event_types":["patch"],"published_at":"2026-10-25T21:22:27.543306+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-02-15T12:00:00+00:00","detail_url":"/advisories/advisory%3A48226981-6425-44b0-ad5d-e6318d96173f","group":{"id":"advisory:48226981-6425-44b0-ad5d-e6318d96173f","revision":1,"primary_event_id":68191,"change":"published","superseded_by":[],"changed":{"id":68191,"cve_ids":[],"payload":{"kind":"patch","title":"February 2016 Security Release Summary","summary":"Node.js released security updates for four release lines, including fixes for announced vulnerabilities and OpenSSL updates. The v4.2.x line is no longer updated; users are advised to upgrade.","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v0.10.42 and v0.12.10 upgrade the bundled version of OpenSSL from 1.0.1q to 1.0.1r."},"prerequisites":[],"fixed_versions":[{"value":"v0.10.42","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v0.12.10","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v4.3.0","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v5.6.0","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:48226981-6425-44b0-ad5d-e6318d96173f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2016-02-15","advisory_id":"48226981-6425-44b0-ad5d-e6318d96173f","event_types":["patch"],"published_at":"2026-10-25T21:22:27.543306+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-02-15T12:00:00+00:00","detail_url":"/events/68191"},"members":[{"id":68191,"cve_ids":[],"payload":{"kind":"patch","title":"February 2016 Security Release Summary","summary":"Node.js released security updates for four release lines, including fixes for announced vulnerabilities and OpenSSL updates. The v4.2.x line is no longer updated; users are advised to upgrade.","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v0.10.42 and v0.12.10 upgrade the bundled version of OpenSSL from 1.0.1q to 1.0.1r."},"prerequisites":[],"fixed_versions":[{"value":"v0.10.42","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v0.12.10","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v4.3.0","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."},{"value":"v5.6.0","evidence":"We had released Node.js v0.10.42 (Maintenance), v0.12.10 (LTS), v4.3.0 \"Argon\" (LTS) and v5.6.0 (Current) with fixes for the announced vulnerabilities and updates to OpenSSL."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:48226981-6425-44b0-ad5d-e6318d96173f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2016-02-15","advisory_id":"48226981-6425-44b0-ad5d-e6318d96173f","event_types":["patch"],"published_at":"2026-10-25T21:22:27.543306+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-02-15T12:00:00+00:00","detail_url":"/events/68191"}]}},{"id":67400,"cve_ids":["CVE-2016-0702","CVE-2016-0705","CVE-2016-0797"],"payload":{"kind":"patch","title":"Node.js 4.3.2 (LTS)","summary":"Node.js 4.3.2 upgrades OpenSSL to 1.0.2g, fixing defects associated with denial of service or memory corruption, and the CacheBleed side-channel attack.","evidence":"openssl: Upgrade from 1.0.2f to 1.0.2g","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.3.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.3.2","evidence":"Node.js 4.3.2 (LTS)"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0705","evidence":"More info is available at CVE-2016-0705."},{"value":"CVE-2016-0797","evidence":"More info is available at CVE-2016-0797."},{"value":"CVE-2016-0702","evidence":"More info is available at CVE-2016-0702."}],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:3dc60eb9-33f3-4df3-807d-a23ecce17562","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.3.2","advisory_id":"3dc60eb9-33f3-4df3-807d-a23ecce17562","event_types":["patch"],"published_at":"2026-10-25T21:15:22.450979+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-02T21:53:44+00:00","detail_url":"/advisories/advisory%3A3dc60eb9-33f3-4df3-807d-a23ecce17562","group":{"id":"advisory:3dc60eb9-33f3-4df3-807d-a23ecce17562","revision":1,"primary_event_id":67770,"change":"published","superseded_by":[],"changed":{"id":67770,"cve_ids":["CVE-2016-0702","CVE-2016-0705","CVE-2016-0797"],"payload":{"kind":"patch","title":"Node.js 4.3.2 (LTS)","summary":"Node.js 4.3.2 upgrades OpenSSL to 1.0.2g, fixing defects associated with denial of service or memory corruption, and the CacheBleed side-channel attack.","evidence":"openssl: Upgrade from 1.0.2f to 1.0.2g","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.3.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.3.2","evidence":"Node.js 4.3.2 (LTS)"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0705","evidence":"More info is available at CVE-2016-0705."},{"value":"CVE-2016-0797","evidence":"More info is available at CVE-2016-0797."},{"value":"CVE-2016-0702","evidence":"More info is available at CVE-2016-0702."}],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:3dc60eb9-33f3-4df3-807d-a23ecce17562","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.3.2","advisory_id":"3dc60eb9-33f3-4df3-807d-a23ecce17562","event_types":["patch"],"published_at":"2026-10-25T21:15:22.450979+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-02T21:53:44+00:00","detail_url":"/events/67770"},"members":[{"id":67770,"cve_ids":["CVE-2016-0702","CVE-2016-0705","CVE-2016-0797"],"payload":{"kind":"patch","title":"Node.js 4.3.2 (LTS)","summary":"Node.js 4.3.2 upgrades OpenSSL to 1.0.2g, fixing defects associated with denial of service or memory corruption, and the CacheBleed side-channel attack.","evidence":"openssl: Upgrade from 1.0.2f to 1.0.2g","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.3.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.3.2","evidence":"Node.js 4.3.2 (LTS)"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0705","evidence":"More info is available at CVE-2016-0705."},{"value":"CVE-2016-0797","evidence":"More info is available at CVE-2016-0797."},{"value":"CVE-2016-0702","evidence":"More info is available at CVE-2016-0702."}],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:3dc60eb9-33f3-4df3-807d-a23ecce17562","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.3.2","advisory_id":"3dc60eb9-33f3-4df3-807d-a23ecce17562","event_types":["patch"],"published_at":"2026-10-25T21:15:22.450979+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-02T21:53:44+00:00","detail_url":"/events/67770"}]}},{"id":67286,"cve_ids":["CVE-2016-0702","CVE-2016-0705","CVE-2016-0797"],"payload":{"kind":"patch","title":"Node.js 5.7.1 security fixes","summary":"Node.js 5.7.1 upgrades OpenSSL to 1.0.2g and includes fixes for defects associated with three CVEs. The announcement describes the issues as low severity for Node.js users or unlikely to enable practical attacks in Node.js.","evidence":"Node.js 5.7.1 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.7.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.7.1","evidence":"Node.js 5.7.1 (Current)"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0705","evidence":"More info is available at CVE-2016-0705."},{"value":"CVE-2016-0797","evidence":"More info is available at CVE-2016-0797."},{"value":"CVE-2016-0702","evidence":"More info is available at CVE-2016-0702."}],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:db8f65bd-8b7e-497e-ba3f-aa924c01d2a8","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.7.1","advisory_id":"db8f65bd-8b7e-497e-ba3f-aa924c01d2a8","event_types":["patch"],"published_at":"2026-10-25T21:13:25.580012+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-02T23:23:06+00:00","detail_url":"/advisories/advisory%3Adb8f65bd-8b7e-497e-ba3f-aa924c01d2a8","group":{"id":"advisory:db8f65bd-8b7e-497e-ba3f-aa924c01d2a8","revision":1,"primary_event_id":67656,"change":"published","superseded_by":[],"changed":{"id":67656,"cve_ids":["CVE-2016-0702","CVE-2016-0705","CVE-2016-0797"],"payload":{"kind":"patch","title":"Node.js 5.7.1 security fixes","summary":"Node.js 5.7.1 upgrades OpenSSL to 1.0.2g and includes fixes for defects associated with three CVEs. The announcement describes the issues as low severity for Node.js users or unlikely to enable practical attacks in Node.js.","evidence":"Node.js 5.7.1 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.7.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.7.1","evidence":"Node.js 5.7.1 (Current)"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0705","evidence":"More info is available at CVE-2016-0705."},{"value":"CVE-2016-0797","evidence":"More info is available at CVE-2016-0797."},{"value":"CVE-2016-0702","evidence":"More info is available at CVE-2016-0702."}],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:db8f65bd-8b7e-497e-ba3f-aa924c01d2a8","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.7.1","advisory_id":"db8f65bd-8b7e-497e-ba3f-aa924c01d2a8","event_types":["patch"],"published_at":"2026-10-25T21:13:25.580012+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-02T23:23:06+00:00","detail_url":"/events/67656"},"members":[{"id":67656,"cve_ids":["CVE-2016-0702","CVE-2016-0705","CVE-2016-0797"],"payload":{"kind":"patch","title":"Node.js 5.7.1 security fixes","summary":"Node.js 5.7.1 upgrades OpenSSL to 1.0.2g and includes fixes for defects associated with three CVEs. The announcement describes the issues as low severity for Node.js users or unlikely to enable practical attacks in Node.js.","evidence":"Node.js 5.7.1 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.7.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.7.1","evidence":"Node.js 5.7.1 (Current)"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-0705","evidence":"More info is available at CVE-2016-0705."},{"value":"CVE-2016-0797","evidence":"More info is available at CVE-2016-0797."},{"value":"CVE-2016-0702","evidence":"More info is available at CVE-2016-0702."}],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:db8f65bd-8b7e-497e-ba3f-aa924c01d2a8","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.7.1","advisory_id":"db8f65bd-8b7e-497e-ba3f-aa924c01d2a8","event_types":["patch"],"published_at":"2026-10-25T21:13:25.580012+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-02T23:23:06+00:00","detail_url":"/events/67656"}]}},{"id":67202,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.11 (LTS)","summary":"Node.js 0.12.11 includes security updates through an OpenSSL upgrade to 1.0.1s, addressing several low-severity defects.","evidence":"This release contains security updates. OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.11","evidence":"Node.js 0.12.11 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:8a10a8dd-3646-4c2a-a905-517156db1266","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.11","advisory_id":"8a10a8dd-3646-4c2a-a905-517156db1266","event_types":["patch"],"published_at":"2026-10-25T21:12:23.121952+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-03T18:07:44+00:00","detail_url":"/advisories/advisory%3A8a10a8dd-3646-4c2a-a905-517156db1266","group":{"id":"advisory:8a10a8dd-3646-4c2a-a905-517156db1266","revision":1,"primary_event_id":67572,"change":"published","superseded_by":[],"changed":{"id":67572,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.11 (LTS)","summary":"Node.js 0.12.11 includes security updates through an OpenSSL upgrade to 1.0.1s, addressing several low-severity defects.","evidence":"This release contains security updates. OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.11","evidence":"Node.js 0.12.11 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:8a10a8dd-3646-4c2a-a905-517156db1266","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.11","advisory_id":"8a10a8dd-3646-4c2a-a905-517156db1266","event_types":["patch"],"published_at":"2026-10-25T21:12:23.121952+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-03T18:07:44+00:00","detail_url":"/events/67572"},"members":[{"id":67572,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.11 (LTS)","summary":"Node.js 0.12.11 includes security updates through an OpenSSL upgrade to 1.0.1s, addressing several low-severity defects.","evidence":"This release contains security updates. OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.11","evidence":"Node.js 0.12.11 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:8a10a8dd-3646-4c2a-a905-517156db1266","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.11","advisory_id":"8a10a8dd-3646-4c2a-a905-517156db1266","event_types":["patch"],"published_at":"2026-10-25T21:12:23.121952+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-03T18:07:44+00:00","detail_url":"/events/67572"}]}},{"id":67160,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.43 (Maintenance)","summary":"Node.js 0.10.43 updates the bundled OpenSSL to 1.0.1s, which includes security fixes, and removes SSLv2 support.","evidence":"This release contains security updates.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.43 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.43","evidence":"Node.js 0.10.43 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"Upgrade from 1.0.1r to 1.0.1s"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:9935675b-3f95-4020-aeb8-6573d3cea4a9","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.43","advisory_id":"9935675b-3f95-4020-aeb8-6573d3cea4a9","event_types":["patch"],"published_at":"2026-10-25T21:11:23.593803+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-04T01:47:40+00:00","detail_url":"/advisories/advisory%3A9935675b-3f95-4020-aeb8-6573d3cea4a9","group":{"id":"advisory:9935675b-3f95-4020-aeb8-6573d3cea4a9","revision":1,"primary_event_id":67530,"change":"published","superseded_by":[],"changed":{"id":67530,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.43 (Maintenance)","summary":"Node.js 0.10.43 updates the bundled OpenSSL to 1.0.1s, which includes security fixes, and removes SSLv2 support.","evidence":"This release contains security updates.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.43 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.43","evidence":"Node.js 0.10.43 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"Upgrade from 1.0.1r to 1.0.1s"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:9935675b-3f95-4020-aeb8-6573d3cea4a9","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.43","advisory_id":"9935675b-3f95-4020-aeb8-6573d3cea4a9","event_types":["patch"],"published_at":"2026-10-25T21:11:23.593803+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-04T01:47:40+00:00","detail_url":"/events/67530"},"members":[{"id":67530,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.43 (Maintenance)","summary":"Node.js 0.10.43 updates the bundled OpenSSL to 1.0.1s, which includes security fixes, and removes SSLv2 support.","evidence":"This release contains security updates.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.43 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.43","evidence":"Node.js 0.10.43 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"Upgrade from 1.0.1r to 1.0.1s"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:9935675b-3f95-4020-aeb8-6573d3cea4a9","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.43","advisory_id":"9935675b-3f95-4020-aeb8-6573d3cea4a9","event_types":["patch"],"published_at":"2026-10-25T21:11:23.593803+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-04T01:47:40+00:00","detail_url":"/events/67530"}]}},{"id":67057,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.12 (LTS)","summary":"Node.js 0.12.12 removes SSLv2 support and makes the --enable-ssl2 argument produce an error, addressing the risk associated with SSLv2 being enabled.","evidence":"openssl: Fully remove SSLv2 support, the --enable-ssl2 command line argument will now produce an error. The DROWN Attack (https://drownattack.com/) creates a vulnerability where SSLv2 is enabled by a server, even if a client connection is not using SSLv2.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.12 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.12","evidence":"Node.js 0.12.12 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3dba0c8a-9309-4462-9fc3-7f8fc165ab02","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.12","advisory_id":"3dba0c8a-9309-4462-9fc3-7f8fc165ab02","event_types":["patch"],"published_at":"2026-10-25T21:09:26.959128+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-09T03:05:35+00:00","detail_url":"/advisories/advisory%3A3dba0c8a-9309-4462-9fc3-7f8fc165ab02","group":{"id":"advisory:3dba0c8a-9309-4462-9fc3-7f8fc165ab02","revision":1,"primary_event_id":67427,"change":"published","superseded_by":[],"changed":{"id":67427,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.12 (LTS)","summary":"Node.js 0.12.12 removes SSLv2 support and makes the --enable-ssl2 argument produce an error, addressing the risk associated with SSLv2 being enabled.","evidence":"openssl: Fully remove SSLv2 support, the --enable-ssl2 command line argument will now produce an error. The DROWN Attack (https://drownattack.com/) creates a vulnerability where SSLv2 is enabled by a server, even if a client connection is not using SSLv2.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.12 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.12","evidence":"Node.js 0.12.12 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3dba0c8a-9309-4462-9fc3-7f8fc165ab02","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.12","advisory_id":"3dba0c8a-9309-4462-9fc3-7f8fc165ab02","event_types":["patch"],"published_at":"2026-10-25T21:09:26.959128+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-09T03:05:35+00:00","detail_url":"/events/67427"},"members":[{"id":67427,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.12 (LTS)","summary":"Node.js 0.12.12 removes SSLv2 support and makes the --enable-ssl2 argument produce an error, addressing the risk associated with SSLv2 being enabled.","evidence":"openssl: Fully remove SSLv2 support, the --enable-ssl2 command line argument will now produce an error. The DROWN Attack (https://drownattack.com/) creates a vulnerability where SSLv2 is enabled by a server, even if a client connection is not using SSLv2.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.12 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.12","evidence":"Node.js 0.12.12 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3dba0c8a-9309-4462-9fc3-7f8fc165ab02","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.12","advisory_id":"3dba0c8a-9309-4462-9fc3-7f8fc165ab02","event_types":["patch"],"published_at":"2026-10-25T21:09:26.959128+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-09T03:05:35+00:00","detail_url":"/events/67427"}]}},{"id":66648,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.9.0 (Current)","summary":"Node.js 5.9.0 fixes a memory consumption issue associated with heavy use of vm.createContext and vm.runInNewContext.","evidence":"contextify: Fixed a memory consumption issue related to heavy use of vm.createContext and vm.runInNewContext.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.9.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.9.0","evidence":"Node.js 5.9.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0b43b71d-ea32-404b-938f-0b1e4c94e505","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.9.0","advisory_id":"0b43b71d-ea32-404b-938f-0b1e4c94e505","event_types":["patch"],"published_at":"2026-10-25T21:03:10.186378+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-16T21:34:26+00:00","detail_url":"/advisories/advisory%3A0b43b71d-ea32-404b-938f-0b1e4c94e505","group":{"id":"advisory:0b43b71d-ea32-404b-938f-0b1e4c94e505","revision":1,"primary_event_id":67018,"change":"published","superseded_by":[],"changed":{"id":67018,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.9.0 (Current)","summary":"Node.js 5.9.0 fixes a memory consumption issue associated with heavy use of vm.createContext and vm.runInNewContext.","evidence":"contextify: Fixed a memory consumption issue related to heavy use of vm.createContext and vm.runInNewContext.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.9.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.9.0","evidence":"Node.js 5.9.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0b43b71d-ea32-404b-938f-0b1e4c94e505","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.9.0","advisory_id":"0b43b71d-ea32-404b-938f-0b1e4c94e505","event_types":["patch"],"published_at":"2026-10-25T21:03:10.186378+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-16T21:34:26+00:00","detail_url":"/events/67018"},"members":[{"id":67018,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.9.0 (Current)","summary":"Node.js 5.9.0 fixes a memory consumption issue associated with heavy use of vm.createContext and vm.runInNewContext.","evidence":"contextify: Fixed a memory consumption issue related to heavy use of vm.createContext and vm.runInNewContext.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.9.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.9.0","evidence":"Node.js 5.9.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0b43b71d-ea32-404b-938f-0b1e4c94e505","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.9.0","advisory_id":"0b43b71d-ea32-404b-938f-0b1e4c94e505","event_types":["patch"],"published_at":"2026-10-25T21:03:10.186378+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-16T21:34:26+00:00","detail_url":"/events/67018"}]}},{"id":66143,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.13 (LTS)","summary":"Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.13 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.13","evidence":"Node.js 0.12.13 will be the final Active-LTS release"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.13","advisory_id":"81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","event_types":["patch"],"published_at":"2026-10-25T20:56:23.154392+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T00:12:07+00:00","detail_url":"/advisories/advisory%3A81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","group":{"id":"advisory:81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","revision":1,"primary_event_id":66513,"change":"published","superseded_by":[],"changed":{"id":66513,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.13 (LTS)","summary":"Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.13 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.13","evidence":"Node.js 0.12.13 will be the final Active-LTS release"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.13","advisory_id":"81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","event_types":["patch"],"published_at":"2026-10-25T20:56:23.154392+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T00:12:07+00:00","detail_url":"/events/66513"},"members":[{"id":66513,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.13 (LTS)","summary":"Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.13 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.13","evidence":"Node.js 0.12.13 will be the final Active-LTS release"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.13","advisory_id":"81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","event_types":["patch"],"published_at":"2026-10-25T20:56:23.154392+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T00:12:07+00:00","detail_url":"/events/66513"}]}},{"id":65996,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.2 (LTS)","summary":"Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.2","evidence":"Node.js 4.4.2 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be41122e-0d63-4bba-b57e-c06869f99610","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.2","advisory_id":"be41122e-0d63-4bba-b57e-c06869f99610","event_types":["patch"],"published_at":"2026-10-25T20:54:21.727605+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T01:47:06+00:00","detail_url":"/advisories/advisory%3Abe41122e-0d63-4bba-b57e-c06869f99610","group":{"id":"advisory:be41122e-0d63-4bba-b57e-c06869f99610","revision":1,"primary_event_id":66366,"change":"published","superseded_by":[],"changed":{"id":66366,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.2 (LTS)","summary":"Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.2","evidence":"Node.js 4.4.2 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be41122e-0d63-4bba-b57e-c06869f99610","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.2","advisory_id":"be41122e-0d63-4bba-b57e-c06869f99610","event_types":["patch"],"published_at":"2026-10-25T20:54:21.727605+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T01:47:06+00:00","detail_url":"/events/66366"},"members":[{"id":66366,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.2 (LTS)","summary":"Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.2","evidence":"Node.js 4.4.2 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be41122e-0d63-4bba-b57e-c06869f99610","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.2","advisory_id":"be41122e-0d63-4bba-b57e-c06869f99610","event_types":["patch"],"published_at":"2026-10-25T20:54:21.727605+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T01:47:06+00:00","detail_url":"/events/66366"}]}},{"id":65878,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.11.1 (Stable)","summary":"Node.js 5.11.1 includes a buffer safeguard and upgrades its OpenSSL sources to 1.0.2h.","evidence":"deps: upgrade openssl sources to 1.0.2h","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.11.1 (Stable)"},"prerequisites":[],"fixed_versions":[{"value":"5.11.1","evidence":"Node.js 5.11.1 (Stable)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:437c6a62-9477-470c-a7ca-01c1e7ed0023","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.11.1","advisory_id":"437c6a62-9477-470c-a7ca-01c1e7ed0023","event_types":["patch"],"published_at":"2026-10-25T20:30:33.708835+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-05T23:00:21+00:00","detail_url":"/advisories/advisory%3A437c6a62-9477-470c-a7ca-01c1e7ed0023","group":{"id":"advisory:437c6a62-9477-470c-a7ca-01c1e7ed0023","revision":1,"primary_event_id":65188,"change":"published","superseded_by":[],"changed":{"id":65188,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.11.1 (Stable)","summary":"Node.js 5.11.1 includes a buffer safeguard and upgrades its OpenSSL sources to 1.0.2h.","evidence":"deps: upgrade openssl sources to 1.0.2h","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.11.1 (Stable)"},"prerequisites":[],"fixed_versions":[{"value":"5.11.1","evidence":"Node.js 5.11.1 (Stable)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:437c6a62-9477-470c-a7ca-01c1e7ed0023","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.11.1","advisory_id":"437c6a62-9477-470c-a7ca-01c1e7ed0023","event_types":["patch"],"published_at":"2026-10-25T20:30:33.708835+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-05T23:00:21+00:00","detail_url":"/events/65188"},"members":[{"id":65188,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.11.1 (Stable)","summary":"Node.js 5.11.1 includes a buffer safeguard and upgrades its OpenSSL sources to 1.0.2h.","evidence":"deps: upgrade openssl sources to 1.0.2h","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.11.1 (Stable)"},"prerequisites":[],"fixed_versions":[{"value":"5.11.1","evidence":"Node.js 5.11.1 (Stable)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:437c6a62-9477-470c-a7ca-01c1e7ed0023","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.11.1","advisory_id":"437c6a62-9477-470c-a7ca-01c1e7ed0023","event_types":["patch"],"published_at":"2026-10-25T20:30:33.708835+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-05T23:00:21+00:00","detail_url":"/events/65188"}]}},{"id":65509,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.4 (LTS)","summary":"Node.js 4.4.4 updates OpenSSL to 1.0.2h and refers readers to a blog post for security details.","evidence":"Node.js 4.4.4 (LTS) Notable changes deps: update openssl to 1.0.2h. (Shigeki Ohtsu) #6551 Please see our blog post for more info on the security contents of this release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.4 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.4","evidence":"Node.js 4.4.4 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e8654e52-eb8f-4d3e-8602-620d8e1f795a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.4","advisory_id":"e8654e52-eb8f-4d3e-8602-620d8e1f795a","event_types":["patch"],"published_at":"2026-10-25T20:24:28.277517+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-06T14:50:41+00:00","detail_url":"/advisories/advisory%3Ae8654e52-eb8f-4d3e-8602-620d8e1f795a","group":{"id":"advisory:e8654e52-eb8f-4d3e-8602-620d8e1f795a","revision":1,"primary_event_id":64827,"change":"published","superseded_by":[],"changed":{"id":64827,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.4 (LTS)","summary":"Node.js 4.4.4 updates OpenSSL to 1.0.2h and refers readers to a blog post for security details.","evidence":"Node.js 4.4.4 (LTS) Notable changes deps: update openssl to 1.0.2h. (Shigeki Ohtsu) #6551 Please see our blog post for more info on the security contents of this release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.4 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.4","evidence":"Node.js 4.4.4 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e8654e52-eb8f-4d3e-8602-620d8e1f795a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.4","advisory_id":"e8654e52-eb8f-4d3e-8602-620d8e1f795a","event_types":["patch"],"published_at":"2026-10-25T20:24:28.277517+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-06T14:50:41+00:00","detail_url":"/events/64827"},"members":[{"id":64827,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.4 (LTS)","summary":"Node.js 4.4.4 updates OpenSSL to 1.0.2h and refers readers to a blog post for security details.","evidence":"Node.js 4.4.4 (LTS) Notable changes deps: update openssl to 1.0.2h. (Shigeki Ohtsu) #6551 Please see our blog post for more info on the security contents of this release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.4 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.4","evidence":"Node.js 4.4.4 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e8654e52-eb8f-4d3e-8602-620d8e1f795a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.4","advisory_id":"e8654e52-eb8f-4d3e-8602-620d8e1f795a","event_types":["patch"],"published_at":"2026-10-25T20:24:28.277517+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-06T14:50:41+00:00","detail_url":"/events/64827"}]}},{"id":65264,"cve_ids":["CVE-2014-9748","CVE-2016-1669","CVE-2016-5325"],"payload":{"kind":"patch","title":"Security updates for all active release lines, June 2016","summary":"Node.js published security updates for active release lines, including fixes for V8 and HTTP-processing flaws. The announcement also lists libuv-related impact and available releases.","evidence":"The fixes we are including in this update are:","products":[{"name":{"value":"Node.js","evidence":"Node.js v5.12.0"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v5.12.0","evidence":"Node.js v5.12.0"},{"value":"Node.js v4.4.6 (LTS \"Argon\")","evidence":"Node.js v4.4.6 (LTS \"Argon\")"},{"value":"Node.js v0.12.15 (Maintenance)","evidence":"Node.js v0.12.15 (Maintenance)"},{"value":"Node.js v0.10.46 (Maintenance)","evidence":"Node.js v0.10.46 (Maintenance)"}],"affected_versions":[{"value":"versions prior to v6.2.0","evidence":"versions prior to v6.2.0 are affected"},{"value":"Node.js v5","evidence":"Node.js v5 is affected"},{"value":"Node.js v4 (LTS \"Argon\")","evidence":"Node.js v4 (LTS \"Argon\") is affected"},{"value":"Node.js v0.12 (Maintenance)","evidence":"Node.js v0.12 (Maintenance) is affected"},{"value":"Node.js v0.10 (Maintenance)","evidence":"Node.js v0.10 (Maintenance) is affected"}]},{"name":{"value":"libuv","evidence":"Prior to libuv version 1.7.4"},"prerequisites":[{"value":"Windows XP and Windows 2003","evidence":"for Windows XP and Windows 2003"}],"fixed_versions":[],"affected_versions":[{"value":"Prior to libuv version 1.7.4","evidence":"Prior to libuv version 1.7.4"}]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-1669","evidence":"CVE-2016-1669 Buffer overflow in V8"},{"value":"CVE-2014-9748","evidence":"CVE-2014-9748 Unsafe use of read/write locks on Windows 2003 and XP in libuv"},{"value":"CVE-2016-5325","evidence":"HTTP processing security defect (CVE-2016-5325)"}],"security_relevant":true,"severity_evidence":"our assessment is that this is low severity for Node.js users"},"group_id":"advisory:37059526-f2ae-4687-843a-845a7e625fda","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/june-2016-security-releases","advisory_id":"37059526-f2ae-4687-843a-845a7e625fda","event_types":["patch"],"published_at":"2026-10-25T20:20:36.738773+00:00","technologies":["libuv","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-13T12:57:51+00:00","detail_url":"/advisories/advisory%3A37059526-f2ae-4687-843a-845a7e625fda","group":{"id":"advisory:37059526-f2ae-4687-843a-845a7e625fda","revision":1,"primary_event_id":64586,"change":"published","superseded_by":[],"changed":{"id":64586,"cve_ids":["CVE-2014-9748","CVE-2016-1669","CVE-2016-5325"],"payload":{"kind":"patch","title":"Security updates for all active release lines, June 2016","summary":"Node.js published security updates for active release lines, including fixes for V8 and HTTP-processing flaws. The announcement also lists libuv-related impact and available releases.","evidence":"The fixes we are including in this update are:","products":[{"name":{"value":"Node.js","evidence":"Node.js v5.12.0"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v5.12.0","evidence":"Node.js v5.12.0"},{"value":"Node.js v4.4.6 (LTS \"Argon\")","evidence":"Node.js v4.4.6 (LTS \"Argon\")"},{"value":"Node.js v0.12.15 (Maintenance)","evidence":"Node.js v0.12.15 (Maintenance)"},{"value":"Node.js v0.10.46 (Maintenance)","evidence":"Node.js v0.10.46 (Maintenance)"}],"affected_versions":[{"value":"versions prior to v6.2.0","evidence":"versions prior to v6.2.0 are affected"},{"value":"Node.js v5","evidence":"Node.js v5 is affected"},{"value":"Node.js v4 (LTS \"Argon\")","evidence":"Node.js v4 (LTS \"Argon\") is affected"},{"value":"Node.js v0.12 (Maintenance)","evidence":"Node.js v0.12 (Maintenance) is affected"},{"value":"Node.js v0.10 (Maintenance)","evidence":"Node.js v0.10 (Maintenance) is affected"}]},{"name":{"value":"libuv","evidence":"Prior to libuv version 1.7.4"},"prerequisites":[{"value":"Windows XP and Windows 2003","evidence":"for Windows XP and Windows 2003"}],"fixed_versions":[],"affected_versions":[{"value":"Prior to libuv version 1.7.4","evidence":"Prior to libuv version 1.7.4"}]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-1669","evidence":"CVE-2016-1669 Buffer overflow in V8"},{"value":"CVE-2014-9748","evidence":"CVE-2014-9748 Unsafe use of read/write locks on Windows 2003 and XP in libuv"},{"value":"CVE-2016-5325","evidence":"HTTP processing security defect (CVE-2016-5325)"}],"security_relevant":true,"severity_evidence":"our assessment is that this is low severity for Node.js users"},"group_id":"advisory:37059526-f2ae-4687-843a-845a7e625fda","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/june-2016-security-releases","advisory_id":"37059526-f2ae-4687-843a-845a7e625fda","event_types":["patch"],"published_at":"2026-10-25T20:20:36.738773+00:00","technologies":["libuv","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-13T12:57:51+00:00","detail_url":"/events/64586"},"members":[{"id":64586,"cve_ids":["CVE-2014-9748","CVE-2016-1669","CVE-2016-5325"],"payload":{"kind":"patch","title":"Security updates for all active release lines, June 2016","summary":"Node.js published security updates for active release lines, including fixes for V8 and HTTP-processing flaws. The announcement also lists libuv-related impact and available releases.","evidence":"The fixes we are including in this update are:","products":[{"name":{"value":"Node.js","evidence":"Node.js v5.12.0"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v5.12.0","evidence":"Node.js v5.12.0"},{"value":"Node.js v4.4.6 (LTS \"Argon\")","evidence":"Node.js v4.4.6 (LTS \"Argon\")"},{"value":"Node.js v0.12.15 (Maintenance)","evidence":"Node.js v0.12.15 (Maintenance)"},{"value":"Node.js v0.10.46 (Maintenance)","evidence":"Node.js v0.10.46 (Maintenance)"}],"affected_versions":[{"value":"versions prior to v6.2.0","evidence":"versions prior to v6.2.0 are affected"},{"value":"Node.js v5","evidence":"Node.js v5 is affected"},{"value":"Node.js v4 (LTS \"Argon\")","evidence":"Node.js v4 (LTS \"Argon\") is affected"},{"value":"Node.js v0.12 (Maintenance)","evidence":"Node.js v0.12 (Maintenance) is affected"},{"value":"Node.js v0.10 (Maintenance)","evidence":"Node.js v0.10 (Maintenance) is affected"}]},{"name":{"value":"libuv","evidence":"Prior to libuv version 1.7.4"},"prerequisites":[{"value":"Windows XP and Windows 2003","evidence":"for Windows XP and Windows 2003"}],"fixed_versions":[],"affected_versions":[{"value":"Prior to libuv version 1.7.4","evidence":"Prior to libuv version 1.7.4"}]}],"severity":"low","fixed_cves":[],"related_cves":[{"value":"CVE-2016-1669","evidence":"CVE-2016-1669 Buffer overflow in V8"},{"value":"CVE-2014-9748","evidence":"CVE-2014-9748 Unsafe use of read/write locks on Windows 2003 and XP in libuv"},{"value":"CVE-2016-5325","evidence":"HTTP processing security defect (CVE-2016-5325)"}],"security_relevant":true,"severity_evidence":"our assessment is that this is low severity for Node.js users"},"group_id":"advisory:37059526-f2ae-4687-843a-845a7e625fda","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/june-2016-security-releases","advisory_id":"37059526-f2ae-4687-843a-845a7e625fda","event_types":["patch"],"published_at":"2026-10-25T20:20:36.738773+00:00","technologies":["libuv","node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-13T12:57:51+00:00","detail_url":"/events/64586"}]}},{"id":65169,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.2.1 (Current)","summary":"Node.js 6.2.1 ignores negative lengths in Buffer allocation calls, addressing a possible memory exposure when unchecked user input is passed to the Buffer constructor or allocUnsafe().","evidence":"This fixes a possible security concern (reported by Feross Aboukhadijeh) where user input is passed unchecked to the Buffer constructor or allocUnsafe() as it can expose parts of the memory slab used by other Buffers in the application.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.2.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"Node.js 6.2.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8d8ebd3d-e7ef-45bd-90cd-865c32151686","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.2.1","advisory_id":"8d8ebd3d-e7ef-45bd-90cd-865c32151686","event_types":["patch"],"published_at":"2026-10-25T20:15:23.281473+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-02T22:47:05+00:00","detail_url":"/advisories/advisory%3A8d8ebd3d-e7ef-45bd-90cd-865c32151686","group":{"id":"advisory:8d8ebd3d-e7ef-45bd-90cd-865c32151686","revision":1,"primary_event_id":64493,"change":"published","superseded_by":[],"changed":{"id":64493,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.2.1 (Current)","summary":"Node.js 6.2.1 ignores negative lengths in Buffer allocation calls, addressing a possible memory exposure when unchecked user input is passed to the Buffer constructor or allocUnsafe().","evidence":"This fixes a possible security concern (reported by Feross Aboukhadijeh) where user input is passed unchecked to the Buffer constructor or allocUnsafe() as it can expose parts of the memory slab used by other Buffers in the application.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.2.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"Node.js 6.2.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8d8ebd3d-e7ef-45bd-90cd-865c32151686","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.2.1","advisory_id":"8d8ebd3d-e7ef-45bd-90cd-865c32151686","event_types":["patch"],"published_at":"2026-10-25T20:15:23.281473+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-02T22:47:05+00:00","detail_url":"/events/64493"},"members":[{"id":64493,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.2.1 (Current)","summary":"Node.js 6.2.1 ignores negative lengths in Buffer allocation calls, addressing a possible memory exposure when unchecked user input is passed to the Buffer constructor or allocUnsafe().","evidence":"This fixes a possible security concern (reported by Feross Aboukhadijeh) where user input is passed unchecked to the Buffer constructor or allocUnsafe() as it can expose parts of the memory slab used by other Buffers in the application.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.2.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"Node.js 6.2.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8d8ebd3d-e7ef-45bd-90cd-865c32151686","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.2.1","advisory_id":"8d8ebd3d-e7ef-45bd-90cd-865c32151686","event_types":["patch"],"published_at":"2026-10-25T20:15:23.281473+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-02T22:47:05+00:00","detail_url":"/events/64493"}]}},{"id":65168,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.6 (LTS)","summary":"Node.js 4.4.6 is an important security release related to a V8 Buffer overflow vulnerability.","evidence":"This is an important security release. All Node.js users should consult the security release summary at nodejs.org for details on patched vulnerabilities. This release is specifically related to a Buffer overflow vulnerability discovered in v8","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.6","evidence":"Node.js 4.4.6 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41864767-99fa-4a06-8892-1a1850cb28f0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.6","advisory_id":"41864767-99fa-4a06-8892-1a1850cb28f0","event_types":["patch"],"published_at":"2026-10-25T20:02:22.18072+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-23T23:29:12+00:00","detail_url":"/advisories/advisory%3A41864767-99fa-4a06-8892-1a1850cb28f0","group":{"id":"advisory:41864767-99fa-4a06-8892-1a1850cb28f0","revision":1,"primary_event_id":64492,"change":"published","superseded_by":[],"changed":{"id":64492,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.6 (LTS)","summary":"Node.js 4.4.6 is an important security release related to a V8 Buffer overflow vulnerability.","evidence":"This is an important security release. All Node.js users should consult the security release summary at nodejs.org for details on patched vulnerabilities. This release is specifically related to a Buffer overflow vulnerability discovered in v8","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.6","evidence":"Node.js 4.4.6 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41864767-99fa-4a06-8892-1a1850cb28f0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.6","advisory_id":"41864767-99fa-4a06-8892-1a1850cb28f0","event_types":["patch"],"published_at":"2026-10-25T20:02:22.18072+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-23T23:29:12+00:00","detail_url":"/events/64492"},"members":[{"id":64492,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.6 (LTS)","summary":"Node.js 4.4.6 is an important security release related to a V8 Buffer overflow vulnerability.","evidence":"This is an important security release. All Node.js users should consult the security release summary at nodejs.org for details on patched vulnerabilities. This release is specifically related to a Buffer overflow vulnerability discovered in v8","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.6","evidence":"Node.js 4.4.6 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41864767-99fa-4a06-8892-1a1850cb28f0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.6","advisory_id":"41864767-99fa-4a06-8892-1a1850cb28f0","event_types":["patch"],"published_at":"2026-10-25T20:02:22.18072+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-23T23:29:12+00:00","detail_url":"/events/64492"}]}},{"id":65138,"cve_ids":[],"payload":{"kind":"advisory","title":"Important security releases","summary":"Node.js security releases are listed, with users directed to a separate summary for details on patched vulnerabilities.","evidence":"These are security releases. All Node.js users should consult the security release summary at /blog/vulnerability/june-2016-security-releases for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"All Node.js users should consult the security release summary"},"prerequisites":[],"fixed_versions":[{"value":"v5.12.0","evidence":"Node v5.12.0 (Stable)"},{"value":"v4.4.6","evidence":"Node v4.4.6 (LTS)"},{"value":"v0.12.15","evidence":"Node v0.12.15 (Maintenance)"},{"value":"v0.10.46","evidence":"Node v0.10.46 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6d566c1a-8ac6-4e20-97d2-41bcc7f83bec","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2016-06-26","advisory_id":"6d566c1a-8ac6-4e20-97d2-41bcc7f83bec","event_types":["advisory"],"published_at":"2026-10-25T20:01:03.955049+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-26T12:00:00+00:00","detail_url":"/advisories/advisory%3A6d566c1a-8ac6-4e20-97d2-41bcc7f83bec","group":{"id":"advisory:6d566c1a-8ac6-4e20-97d2-41bcc7f83bec","revision":1,"primary_event_id":64462,"change":"published","superseded_by":[],"changed":{"id":64462,"cve_ids":[],"payload":{"kind":"advisory","title":"Important security releases","summary":"Node.js security releases are listed, with users directed to a separate summary for details on patched vulnerabilities.","evidence":"These are security releases. All Node.js users should consult the security release summary at /blog/vulnerability/june-2016-security-releases for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"All Node.js users should consult the security release summary"},"prerequisites":[],"fixed_versions":[{"value":"v5.12.0","evidence":"Node v5.12.0 (Stable)"},{"value":"v4.4.6","evidence":"Node v4.4.6 (LTS)"},{"value":"v0.12.15","evidence":"Node v0.12.15 (Maintenance)"},{"value":"v0.10.46","evidence":"Node v0.10.46 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6d566c1a-8ac6-4e20-97d2-41bcc7f83bec","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2016-06-26","advisory_id":"6d566c1a-8ac6-4e20-97d2-41bcc7f83bec","event_types":["advisory"],"published_at":"2026-10-25T20:01:03.955049+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-26T12:00:00+00:00","detail_url":"/events/64462"},"members":[{"id":64462,"cve_ids":[],"payload":{"kind":"advisory","title":"Important security releases","summary":"Node.js security releases are listed, with users directed to a separate summary for details on patched vulnerabilities.","evidence":"These are security releases. All Node.js users should consult the security release summary at /blog/vulnerability/june-2016-security-releases for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"All Node.js users should consult the security release summary"},"prerequisites":[],"fixed_versions":[{"value":"v5.12.0","evidence":"Node v5.12.0 (Stable)"},{"value":"v4.4.6","evidence":"Node v4.4.6 (LTS)"},{"value":"v0.12.15","evidence":"Node v0.12.15 (Maintenance)"},{"value":"v0.10.46","evidence":"Node v0.10.46 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6d566c1a-8ac6-4e20-97d2-41bcc7f83bec","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/weekly/weekly-update.2016-06-26","advisory_id":"6d566c1a-8ac6-4e20-97d2-41bcc7f83bec","event_types":["advisory"],"published_at":"2026-10-25T20:01:03.955049+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-06-26T12:00:00+00:00","detail_url":"/events/64462"}]}},{"id":65115,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.10.0 (Current)","summary":"Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.10.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.10.0","evidence":"Node.js 5.10.0 (Current)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v3.8.3."},"prerequisites":[],"fixed_versions":[{"value":"v3.8.3","evidence":"npm: Upgrade to v3.8.3."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98c4c5be-1a9f-466d-9251-91f40f74b655","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.10.0","advisory_id":"98c4c5be-1a9f-466d-9251-91f40f74b655","event_types":["patch"],"published_at":"2026-10-25T20:53:24.471943+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T03:31:50+00:00","detail_url":"/advisories/advisory%3A98c4c5be-1a9f-466d-9251-91f40f74b655","group":{"id":"advisory:98c4c5be-1a9f-466d-9251-91f40f74b655","revision":1,"primary_event_id":66294,"change":"published","superseded_by":[],"changed":{"id":66294,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.10.0 (Current)","summary":"Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.10.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.10.0","evidence":"Node.js 5.10.0 (Current)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v3.8.3."},"prerequisites":[],"fixed_versions":[{"value":"v3.8.3","evidence":"npm: Upgrade to v3.8.3."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98c4c5be-1a9f-466d-9251-91f40f74b655","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.10.0","advisory_id":"98c4c5be-1a9f-466d-9251-91f40f74b655","event_types":["patch"],"published_at":"2026-10-25T20:53:24.471943+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T03:31:50+00:00","detail_url":"/events/66294"},"members":[{"id":66294,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.10.0 (Current)","summary":"Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.10.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.10.0","evidence":"Node.js 5.10.0 (Current)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v3.8.3."},"prerequisites":[],"fixed_versions":[{"value":"v3.8.3","evidence":"npm: Upgrade to v3.8.3."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98c4c5be-1a9f-466d-9251-91f40f74b655","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.10.0","advisory_id":"98c4c5be-1a9f-466d-9251-91f40f74b655","event_types":["patch"],"published_at":"2026-10-25T20:53:24.471943+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T03:31:50+00:00","detail_url":"/events/66294"}]}},{"id":63465,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6303","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 4.6.0 (LTS)","summary":"Node.js 4.6.0 (LTS) is an important security release that updates OpenSSL and patches HTTP and TLS vulnerabilities, among other security changes.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.6.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.6.0","evidence":"Node.js 4.6.0 (LTS)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-6303","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead()."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#46 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#65 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check"}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183"},{"value":"CVE-2016-6303","evidence":"CVE-2016-6303"},{"value":"CVE-2016-2178","evidence":"CVE-2016-2178"},{"value":"CVE-2016-6306","evidence":"CVE-2016-6306"},{"value":"CVE-2016-7052","evidence":"CVE-2016-7052"},{"value":"CVE-2016-5325","evidence":"CVE-2016-5325"},{"value":"CVE-2016-7099","evidence":"CVE-2016-7099"}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:5402985e-9a11-4aea-a529-3b81fbeb7d78","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.6.0","advisory_id":"5402985e-9a11-4aea-a529-3b81fbeb7d78","event_types":["patch"],"published_at":"2026-10-25T19:32:33.194831+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:47:06+00:00","detail_url":"/advisories/advisory%3A5402985e-9a11-4aea-a529-3b81fbeb7d78","group":{"id":"advisory:5402985e-9a11-4aea-a529-3b81fbeb7d78","revision":1,"primary_event_id":62746,"change":"published","superseded_by":[],"changed":{"id":62746,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6303","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 4.6.0 (LTS)","summary":"Node.js 4.6.0 (LTS) is an important security release that updates OpenSSL and patches HTTP and TLS vulnerabilities, among other security changes.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.6.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.6.0","evidence":"Node.js 4.6.0 (LTS)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-6303","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead()."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#46 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#65 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check"}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183"},{"value":"CVE-2016-6303","evidence":"CVE-2016-6303"},{"value":"CVE-2016-2178","evidence":"CVE-2016-2178"},{"value":"CVE-2016-6306","evidence":"CVE-2016-6306"},{"value":"CVE-2016-7052","evidence":"CVE-2016-7052"},{"value":"CVE-2016-5325","evidence":"CVE-2016-5325"},{"value":"CVE-2016-7099","evidence":"CVE-2016-7099"}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:5402985e-9a11-4aea-a529-3b81fbeb7d78","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.6.0","advisory_id":"5402985e-9a11-4aea-a529-3b81fbeb7d78","event_types":["patch"],"published_at":"2026-10-25T19:32:33.194831+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:47:06+00:00","detail_url":"/events/62746"},"members":[{"id":62746,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6303","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 4.6.0 (LTS)","summary":"Node.js 4.6.0 (LTS) is an important security release that updates OpenSSL and patches HTTP and TLS vulnerabilities, among other security changes.","evidence":"This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.6.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.6.0","evidence":"Node.js 4.6.0 (LTS)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-6303","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead()."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 4.6.0 (LTS) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable Changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#46 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#65 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check"}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183"},{"value":"CVE-2016-6303","evidence":"CVE-2016-6303"},{"value":"CVE-2016-2178","evidence":"CVE-2016-2178"},{"value":"CVE-2016-6306","evidence":"CVE-2016-6306"},{"value":"CVE-2016-7052","evidence":"CVE-2016-7052"},{"value":"CVE-2016-5325","evidence":"CVE-2016-5325"},{"value":"CVE-2016-7099","evidence":"CVE-2016-7099"}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:5402985e-9a11-4aea-a529-3b81fbeb7d78","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.6.0","advisory_id":"5402985e-9a11-4aea-a529-3b81fbeb7d78","event_types":["patch"],"published_at":"2026-10-25T19:32:33.194831+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:47:06+00:00","detail_url":"/events/62746"}]}},{"id":63061,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 6.7.0 (Current)","summary":"Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.","evidence":"Node.js 6.7.0 (Current) This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.7.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.7.0","evidence":"Node.js 6.7.0 (Current)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#60 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#64 src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) #8572 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-2178","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-6306","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-7052","evidence":"Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"value":"CVE-2016-5325","evidence":"http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"value":"CVE-2016-7099","evidence":"tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:716b05fd-10c0-4a7b-b4b8-c2e86940f80b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.7.0","advisory_id":"716b05fd-10c0-4a7b-b4b8-c2e86940f80b","event_types":["patch"],"published_at":"2026-10-25T19:16:39.667156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:49:35+00:00","detail_url":"/advisories/advisory%3A716b05fd-10c0-4a7b-b4b8-c2e86940f80b","group":{"id":"advisory:716b05fd-10c0-4a7b-b4b8-c2e86940f80b","revision":1,"primary_event_id":62294,"change":"published","superseded_by":[],"changed":{"id":62294,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 6.7.0 (Current)","summary":"Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.","evidence":"Node.js 6.7.0 (Current) This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.7.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.7.0","evidence":"Node.js 6.7.0 (Current)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#60 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#64 src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) #8572 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-2178","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-6306","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-7052","evidence":"Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"value":"CVE-2016-5325","evidence":"http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"value":"CVE-2016-7099","evidence":"tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:716b05fd-10c0-4a7b-b4b8-c2e86940f80b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.7.0","advisory_id":"716b05fd-10c0-4a7b-b4b8-c2e86940f80b","event_types":["patch"],"published_at":"2026-10-25T19:16:39.667156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:49:35+00:00","detail_url":"/events/62294"},"members":[{"id":62294,"cve_ids":["CVE-2016-2178","CVE-2016-2183","CVE-2016-5325","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099"],"payload":{"kind":"patch","title":"Node.js 6.7.0 (Current)","summary":"Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.","evidence":"Node.js 6.7.0 (Current) This is an important security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.7.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"6.7.0","evidence":"Node.js 6.7.0 (Current)"}],"affected_versions":[]}],"severity":"high","fixed_cves":[{"cve":"CVE-2016-6304","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304"},{"cve":"CVE-2016-2183","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183"},{"cve":"CVE-2016-2178","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178"},{"cve":"CVE-2016-6306","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"cve":"CVE-2016-7052","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"cve":"CVE-2016-5325","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"cve":"CVE-2016-7099","product":"Node.js","evidence":"Node.js 6.7.0 (Current) This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities. Notable changes Semver Minor: openssl: Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714 Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786 Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73 http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#60 Semver Patch: buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#64 src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) #8572 tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"related_cves":[{"value":"CVE-2016-6304","evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},{"value":"CVE-2016-2183","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-2178","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-6306","evidence":"CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306."},{"value":"CVE-2016-7052","evidence":"Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052."},{"value":"CVE-2016-5325","evidence":"http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector."},{"value":"CVE-2016-7099","evidence":"tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string."}],"security_relevant":true,"severity_evidence":"CVE-2016-6304 (\"OCSP Status Request extension unbounded memory growth\", high severity)"},"group_id":"advisory:716b05fd-10c0-4a7b-b4b8-c2e86940f80b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.7.0","advisory_id":"716b05fd-10c0-4a7b-b4b8-c2e86940f80b","event_types":["patch"],"published_at":"2026-10-25T19:16:39.667156+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-09-28T00:49:35+00:00","detail_url":"/events/62294"}]}},{"id":62237,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.44 (Maintenance)","summary":"Node.js 0.10.44 updates bundled npm to address an authentication-token leak and disables obsolete EXPORT and LOW OpenSSL ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.44 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.44","evidence":"Node.js 0.10.44 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[{"value":"the command-line interface","evidence":"collect tokens from users of the command-line interface."}],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8f45c327-47c9-4f2f-89f0-2d6b3a937051","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.44","advisory_id":"8f45c327-47c9-4f2f-89f0-2d6b3a937051","event_types":["patch"],"published_at":"2026-10-25T20:52:11.257568+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T04:35:44+00:00","detail_url":"/advisories/advisory%3A8f45c327-47c9-4f2f-89f0-2d6b3a937051","group":{"id":"advisory:8f45c327-47c9-4f2f-89f0-2d6b3a937051","revision":1,"primary_event_id":66233,"change":"published","superseded_by":[],"changed":{"id":66233,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.44 (Maintenance)","summary":"Node.js 0.10.44 updates bundled npm to address an authentication-token leak and disables obsolete EXPORT and LOW OpenSSL ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.44 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.44","evidence":"Node.js 0.10.44 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[{"value":"the command-line interface","evidence":"collect tokens from users of the command-line interface."}],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8f45c327-47c9-4f2f-89f0-2d6b3a937051","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.44","advisory_id":"8f45c327-47c9-4f2f-89f0-2d6b3a937051","event_types":["patch"],"published_at":"2026-10-25T20:52:11.257568+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T04:35:44+00:00","detail_url":"/events/66233"},"members":[{"id":66233,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.44 (Maintenance)","summary":"Node.js 0.10.44 updates bundled npm to address an authentication-token leak and disables obsolete EXPORT and LOW OpenSSL ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.44 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.44","evidence":"Node.js 0.10.44 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[{"value":"the command-line interface","evidence":"collect tokens from users of the command-line interface."}],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8f45c327-47c9-4f2f-89f0-2d6b3a937051","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.44","advisory_id":"8f45c327-47c9-4f2f-89f0-2d6b3a937051","event_types":["patch"],"published_at":"2026-10-25T20:52:11.257568+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T04:35:44+00:00","detail_url":"/events/66233"}]}},{"id":62065,"cve_ids":["CVE-2016-9551"],"payload":{"kind":"patch","title":"Node.js 7.2.0 (Current)","summary":"Node.js 7.2.0 is a security release impacting Windows 10 users. It fixes a potential buffer overflow when writing data to the console on Windows 10.","evidence":"This is a security release impacting Windows 10 users. Notable changes","products":[{"name":{"value":"Node.js","evidence":"Node.js 7.2.0 (Current)"},"prerequisites":[{"value":"Windows 10 users","evidence":"This is a security release impacting Windows 10 users."}],"fixed_versions":[{"value":"7.2.0","evidence":"Node.js 7.2.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2016-9551","product":"Node.js","evidence":"Node.js 7.2.0 (Current) This is a security release impacting Windows 10 users. Notable changes crypto: The Decipher methods setAuthTag() and setAAD now return this. (Kirill Fomichev) #9398 dns: Implemented {ttl: true} for resolve4() and resolve6(). (Ben Noordhuis) #9296 & #9296 libuv: Upgrade to v1.10.1 (cjihrig) #9647 Fixed a potential buffer overflow when writing data to console on Windows 10. (CVE-2016-9551)"}],"related_cves":[{"value":"CVE-2016-9551","evidence":"Fixed a potential buffer overflow when writing data to console on Windows 10. (CVE-2016-9551)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:47f024ed-7d4d-4b76-b2d7-d6219d12c923","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v7.2.0","advisory_id":"47f024ed-7d4d-4b76-b2d7-d6219d12c923","event_types":["patch"],"published_at":"2026-10-25T19:00:27.011566+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-11-22T23:48:43+00:00","detail_url":"/advisories/advisory%3A47f024ed-7d4d-4b76-b2d7-d6219d12c923","group":{"id":"advisory:47f024ed-7d4d-4b76-b2d7-d6219d12c923","revision":1,"primary_event_id":61306,"change":"published","superseded_by":[],"changed":{"id":61306,"cve_ids":["CVE-2016-9551"],"payload":{"kind":"patch","title":"Node.js 7.2.0 (Current)","summary":"Node.js 7.2.0 is a security release impacting Windows 10 users. It fixes a potential buffer overflow when writing data to the console on Windows 10.","evidence":"This is a security release impacting Windows 10 users. Notable changes","products":[{"name":{"value":"Node.js","evidence":"Node.js 7.2.0 (Current)"},"prerequisites":[{"value":"Windows 10 users","evidence":"This is a security release impacting Windows 10 users."}],"fixed_versions":[{"value":"7.2.0","evidence":"Node.js 7.2.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2016-9551","product":"Node.js","evidence":"Node.js 7.2.0 (Current) This is a security release impacting Windows 10 users. Notable changes crypto: The Decipher methods setAuthTag() and setAAD now return this. (Kirill Fomichev) #9398 dns: Implemented {ttl: true} for resolve4() and resolve6(). (Ben Noordhuis) #9296 & #9296 libuv: Upgrade to v1.10.1 (cjihrig) #9647 Fixed a potential buffer overflow when writing data to console on Windows 10. (CVE-2016-9551)"}],"related_cves":[{"value":"CVE-2016-9551","evidence":"Fixed a potential buffer overflow when writing data to console on Windows 10. (CVE-2016-9551)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:47f024ed-7d4d-4b76-b2d7-d6219d12c923","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v7.2.0","advisory_id":"47f024ed-7d4d-4b76-b2d7-d6219d12c923","event_types":["patch"],"published_at":"2026-10-25T19:00:27.011566+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-11-22T23:48:43+00:00","detail_url":"/events/61306"},"members":[{"id":61306,"cve_ids":["CVE-2016-9551"],"payload":{"kind":"patch","title":"Node.js 7.2.0 (Current)","summary":"Node.js 7.2.0 is a security release impacting Windows 10 users. It fixes a potential buffer overflow when writing data to the console on Windows 10.","evidence":"This is a security release impacting Windows 10 users. Notable changes","products":[{"name":{"value":"Node.js","evidence":"Node.js 7.2.0 (Current)"},"prerequisites":[{"value":"Windows 10 users","evidence":"This is a security release impacting Windows 10 users."}],"fixed_versions":[{"value":"7.2.0","evidence":"Node.js 7.2.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2016-9551","product":"Node.js","evidence":"Node.js 7.2.0 (Current) This is a security release impacting Windows 10 users. Notable changes crypto: The Decipher methods setAuthTag() and setAAD now return this. (Kirill Fomichev) #9398 dns: Implemented {ttl: true} for resolve4() and resolve6(). (Ben Noordhuis) #9296 & #9296 libuv: Upgrade to v1.10.1 (cjihrig) #9647 Fixed a potential buffer overflow when writing data to console on Windows 10. (CVE-2016-9551)"}],"related_cves":[{"value":"CVE-2016-9551","evidence":"Fixed a potential buffer overflow when writing data to console on Windows 10. (CVE-2016-9551)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:47f024ed-7d4d-4b76-b2d7-d6219d12c923","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v7.2.0","advisory_id":"47f024ed-7d4d-4b76-b2d7-d6219d12c923","event_types":["patch"],"published_at":"2026-10-25T19:00:27.011566+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-11-22T23:48:43+00:00","detail_url":"/events/61306"}]}},{"id":60983,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.9.2 (LTS)","summary":"Node.js 6.9.2 includes a fix for a memory leak during TLS handshakes.","evidence":"tls: fix memory leak when writing data to TLSWrap instance during handshake","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.9.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.9.2","evidence":"Node.js 6.9.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e67b351-2640-40f0-82d3-1fd615dc8781","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.9.2","advisory_id":"3e67b351-2640-40f0-82d3-1fd615dc8781","event_types":["patch"],"published_at":"2026-10-25T18:44:22.275591+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-12-06T19:39:44+00:00","detail_url":"/advisories/advisory%3A3e67b351-2640-40f0-82d3-1fd615dc8781","group":{"id":"advisory:3e67b351-2640-40f0-82d3-1fd615dc8781","revision":1,"primary_event_id":60239,"change":"published","superseded_by":[],"changed":{"id":60239,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.9.2 (LTS)","summary":"Node.js 6.9.2 includes a fix for a memory leak during TLS handshakes.","evidence":"tls: fix memory leak when writing data to TLSWrap instance during handshake","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.9.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.9.2","evidence":"Node.js 6.9.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e67b351-2640-40f0-82d3-1fd615dc8781","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.9.2","advisory_id":"3e67b351-2640-40f0-82d3-1fd615dc8781","event_types":["patch"],"published_at":"2026-10-25T18:44:22.275591+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-12-06T19:39:44+00:00","detail_url":"/events/60239"},"members":[{"id":60239,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.9.2 (LTS)","summary":"Node.js 6.9.2 includes a fix for a memory leak during TLS handshakes.","evidence":"tls: fix memory leak when writing data to TLSWrap instance during handshake","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.9.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.9.2","evidence":"Node.js 6.9.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e67b351-2640-40f0-82d3-1fd615dc8781","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.9.2","advisory_id":"3e67b351-2640-40f0-82d3-1fd615dc8781","event_types":["patch"],"published_at":"2026-10-25T18:44:22.275591+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-12-06T19:39:44+00:00","detail_url":"/events/60239"}]}},{"id":60906,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.7.0 (LTS)","summary":"Node.js 4.7.0 includes a TLS memory leak fix and other changes. The announcement does not identify a security vulnerability or CVE.","evidence":"tls: fix memory leak when writing data to TLSWrap instance during handshake (Fedor Indutny) #9586","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.7.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.7.0","evidence":"Node.js 4.7.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ef860003-72fe-4d3c-81dc-5b605a08bd95","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.7.0","advisory_id":"ef860003-72fe-4d3c-81dc-5b605a08bd95","event_types":["patch"],"published_at":"2026-10-25T18:43:24.353699+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-12-06T20:16:34+00:00","detail_url":"/advisories/advisory%3Aef860003-72fe-4d3c-81dc-5b605a08bd95","group":{"id":"advisory:ef860003-72fe-4d3c-81dc-5b605a08bd95","revision":1,"primary_event_id":60164,"change":"published","superseded_by":[],"changed":{"id":60164,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.7.0 (LTS)","summary":"Node.js 4.7.0 includes a TLS memory leak fix and other changes. The announcement does not identify a security vulnerability or CVE.","evidence":"tls: fix memory leak when writing data to TLSWrap instance during handshake (Fedor Indutny) #9586","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.7.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.7.0","evidence":"Node.js 4.7.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ef860003-72fe-4d3c-81dc-5b605a08bd95","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.7.0","advisory_id":"ef860003-72fe-4d3c-81dc-5b605a08bd95","event_types":["patch"],"published_at":"2026-10-25T18:43:24.353699+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-12-06T20:16:34+00:00","detail_url":"/events/60164"},"members":[{"id":60164,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.7.0 (LTS)","summary":"Node.js 4.7.0 includes a TLS memory leak fix and other changes. The announcement does not identify a security vulnerability or CVE.","evidence":"tls: fix memory leak when writing data to TLSWrap instance during handshake (Fedor Indutny) #9586","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.7.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.7.0","evidence":"Node.js 4.7.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ef860003-72fe-4d3c-81dc-5b605a08bd95","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.7.0","advisory_id":"ef860003-72fe-4d3c-81dc-5b605a08bd95","event_types":["patch"],"published_at":"2026-10-25T18:43:24.353699+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-12-06T20:16:34+00:00","detail_url":"/events/60164"}]}},{"id":60180,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.9.5 (LTS)","summary":"Node.js 6.9.5 upgrades its OpenSSL sources to 1.0.2k. The announcement does not identify a CVE or explicitly characterize the update as a security fix.","evidence":"deps: upgrade openssl sources to 1.0.2k","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.9.5 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.9.5","evidence":"Node.js 6.9.5 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f4914dc8-3998-4b89-a213-649588824c0b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.9.5","advisory_id":"f4914dc8-3998-4b89-a213-649588824c0b","event_types":["patch"],"published_at":"2026-10-25T18:27:30.063108+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-02-01T00:56:04+00:00","detail_url":"/advisories/advisory%3Af4914dc8-3998-4b89-a213-649588824c0b","group":{"id":"advisory:f4914dc8-3998-4b89-a213-649588824c0b","revision":1,"primary_event_id":59383,"change":"published","superseded_by":[],"changed":{"id":59383,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.9.5 (LTS)","summary":"Node.js 6.9.5 upgrades its OpenSSL sources to 1.0.2k. The announcement does not identify a CVE or explicitly characterize the update as a security fix.","evidence":"deps: upgrade openssl sources to 1.0.2k","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.9.5 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.9.5","evidence":"Node.js 6.9.5 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f4914dc8-3998-4b89-a213-649588824c0b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.9.5","advisory_id":"f4914dc8-3998-4b89-a213-649588824c0b","event_types":["patch"],"published_at":"2026-10-25T18:27:30.063108+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-02-01T00:56:04+00:00","detail_url":"/events/59383"},"members":[{"id":59383,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.9.5 (LTS)","summary":"Node.js 6.9.5 upgrades its OpenSSL sources to 1.0.2k. The announcement does not identify a CVE or explicitly characterize the update as a security fix.","evidence":"deps: upgrade openssl sources to 1.0.2k","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.9.5 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.9.5","evidence":"Node.js 6.9.5 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f4914dc8-3998-4b89-a213-649588824c0b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.9.5","advisory_id":"f4914dc8-3998-4b89-a213-649588824c0b","event_types":["patch"],"published_at":"2026-10-25T18:27:30.063108+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-02-01T00:56:04+00:00","detail_url":"/events/59383"}]}},{"id":60174,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.7.3 (LTS)","summary":"Node.js 4.7.3 updates its OpenSSL sources to 1.0.2k.","evidence":"deps: upgrade openssl sources to 1.0.2k","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.7.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.7.3","evidence":"Node.js 4.7.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41217b71-1b3c-4fc9-9074-1f0904d3291a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.7.3","advisory_id":"41217b71-1b3c-4fc9-9074-1f0904d3291a","event_types":["patch"],"published_at":"2026-10-25T18:27:24.058683+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-02-01T01:04:43+00:00","detail_url":"/advisories/advisory%3A41217b71-1b3c-4fc9-9074-1f0904d3291a","group":{"id":"advisory:41217b71-1b3c-4fc9-9074-1f0904d3291a","revision":1,"primary_event_id":59377,"change":"published","superseded_by":[],"changed":{"id":59377,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.7.3 (LTS)","summary":"Node.js 4.7.3 updates its OpenSSL sources to 1.0.2k.","evidence":"deps: upgrade openssl sources to 1.0.2k","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.7.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.7.3","evidence":"Node.js 4.7.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41217b71-1b3c-4fc9-9074-1f0904d3291a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.7.3","advisory_id":"41217b71-1b3c-4fc9-9074-1f0904d3291a","event_types":["patch"],"published_at":"2026-10-25T18:27:24.058683+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-02-01T01:04:43+00:00","detail_url":"/events/59377"},"members":[{"id":59377,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.7.3 (LTS)","summary":"Node.js 4.7.3 updates its OpenSSL sources to 1.0.2k.","evidence":"deps: upgrade openssl sources to 1.0.2k","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.7.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.7.3","evidence":"Node.js 4.7.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:41217b71-1b3c-4fc9-9074-1f0904d3291a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.7.3","advisory_id":"41217b71-1b3c-4fc9-9074-1f0904d3291a","event_types":["patch"],"published_at":"2026-10-25T18:27:24.058683+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-02-01T01:04:43+00:00","detail_url":"/events/59377"}]}},{"id":59620,"cve_ids":[],"payload":{"kind":"other","title":"Node.js 7.7.0 release warns that native modules cannot load","summary":"Node.js 7.7.0 contains a bug that prevents native modules from loading; a patch release was expected shortly. No security vulnerability or fix is stated.","evidence":"This release contains a bug that will prevent all native modules from loading. A patch release (7.7.1) will be coming shortly.","products":[{"name":{"value":"Node.js","evidence":"Node.js 7.7.0 (Current)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"7.7.0","evidence":"Node.js 7.7.0 (Current)"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:34e2e782-2c4a-47ca-b98b-fc30adbdcad3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v7.7.0","advisory_id":"34e2e782-2c4a-47ca-b98b-fc30adbdcad3","event_types":["other"],"published_at":"2026-10-25T18:17:37.28724+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-03-01T03:05:14+00:00","detail_url":"/advisories/advisory%3A34e2e782-2c4a-47ca-b98b-fc30adbdcad3","group":{"id":"advisory:34e2e782-2c4a-47ca-b98b-fc30adbdcad3","revision":1,"primary_event_id":58835,"change":"published","superseded_by":[],"changed":{"id":58835,"cve_ids":[],"payload":{"kind":"other","title":"Node.js 7.7.0 release warns that native modules cannot load","summary":"Node.js 7.7.0 contains a bug that prevents native modules from loading; a patch release was expected shortly. No security vulnerability or fix is stated.","evidence":"This release contains a bug that will prevent all native modules from loading. A patch release (7.7.1) will be coming shortly.","products":[{"name":{"value":"Node.js","evidence":"Node.js 7.7.0 (Current)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"7.7.0","evidence":"Node.js 7.7.0 (Current)"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:34e2e782-2c4a-47ca-b98b-fc30adbdcad3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v7.7.0","advisory_id":"34e2e782-2c4a-47ca-b98b-fc30adbdcad3","event_types":["other"],"published_at":"2026-10-25T18:17:37.28724+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-03-01T03:05:14+00:00","detail_url":"/events/58835"},"members":[{"id":58835,"cve_ids":[],"payload":{"kind":"other","title":"Node.js 7.7.0 release warns that native modules cannot load","summary":"Node.js 7.7.0 contains a bug that prevents native modules from loading; a patch release was expected shortly. No security vulnerability or fix is stated.","evidence":"This release contains a bug that will prevent all native modules from loading. A patch release (7.7.1) will be coming shortly.","products":[{"name":{"value":"Node.js","evidence":"Node.js 7.7.0 (Current)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"7.7.0","evidence":"Node.js 7.7.0 (Current)"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:34e2e782-2c4a-47ca-b98b-fc30adbdcad3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v7.7.0","advisory_id":"34e2e782-2c4a-47ca-b98b-fc30adbdcad3","event_types":["other"],"published_at":"2026-10-25T18:17:37.28724+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-03-01T03:05:14+00:00","detail_url":"/events/58835"}]}},{"id":59279,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.10.2 (LTS)","summary":"Node.js 6.10.2 includes a fix for a crypto memory leak when a certificate is revoked.","evidence":"crypto: fix memory leak if certificate is revoked","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.10.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.10.2","evidence":"Node.js 6.10.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9f57e926-5ccb-40b1-8f4d-45cc74dfb857","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.10.2","advisory_id":"9f57e926-5ccb-40b1-8f4d-45cc74dfb857","event_types":["patch"],"published_at":"2026-10-25T18:08:33.302482+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-04-04T12:36:54+00:00","detail_url":"/advisories/advisory%3A9f57e926-5ccb-40b1-8f4d-45cc74dfb857","group":{"id":"advisory:9f57e926-5ccb-40b1-8f4d-45cc74dfb857","revision":1,"primary_event_id":58503,"change":"published","superseded_by":[],"changed":{"id":58503,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.10.2 (LTS)","summary":"Node.js 6.10.2 includes a fix for a crypto memory leak when a certificate is revoked.","evidence":"crypto: fix memory leak if certificate is revoked","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.10.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.10.2","evidence":"Node.js 6.10.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9f57e926-5ccb-40b1-8f4d-45cc74dfb857","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.10.2","advisory_id":"9f57e926-5ccb-40b1-8f4d-45cc74dfb857","event_types":["patch"],"published_at":"2026-10-25T18:08:33.302482+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-04-04T12:36:54+00:00","detail_url":"/events/58503"},"members":[{"id":58503,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.10.2 (LTS)","summary":"Node.js 6.10.2 includes a fix for a crypto memory leak when a certificate is revoked.","evidence":"crypto: fix memory leak if certificate is revoked","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.10.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.10.2","evidence":"Node.js 6.10.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9f57e926-5ccb-40b1-8f4d-45cc74dfb857","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.10.2","advisory_id":"9f57e926-5ccb-40b1-8f4d-45cc74dfb857","event_types":["patch"],"published_at":"2026-10-25T18:08:33.302482+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-04-04T12:36:54+00:00","detail_url":"/events/58503"}]}},{"id":59253,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.8.2 (Maintenance)","summary":"Node.js 4.8.2 fixes a memory leak when a certificate is revoked.","evidence":"crypto: fix memory leak if certificate is revoked","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.8.2 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"4.8.2","evidence":"Node.js 4.8.2 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea3d0514-c3fe-424b-ab99-93da2e2449b6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.8.2","advisory_id":"ea3d0514-c3fe-424b-ab99-93da2e2449b6","event_types":["patch"],"published_at":"2026-10-25T18:05:20.803244+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-04-04T12:43:39+00:00","detail_url":"/advisories/advisory%3Aea3d0514-c3fe-424b-ab99-93da2e2449b6","group":{"id":"advisory:ea3d0514-c3fe-424b-ab99-93da2e2449b6","revision":1,"primary_event_id":58477,"change":"published","superseded_by":[],"changed":{"id":58477,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.8.2 (Maintenance)","summary":"Node.js 4.8.2 fixes a memory leak when a certificate is revoked.","evidence":"crypto: fix memory leak if certificate is revoked","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.8.2 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"4.8.2","evidence":"Node.js 4.8.2 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea3d0514-c3fe-424b-ab99-93da2e2449b6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.8.2","advisory_id":"ea3d0514-c3fe-424b-ab99-93da2e2449b6","event_types":["patch"],"published_at":"2026-10-25T18:05:20.803244+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-04-04T12:43:39+00:00","detail_url":"/events/58477"},"members":[{"id":58477,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.8.2 (Maintenance)","summary":"Node.js 4.8.2 fixes a memory leak when a certificate is revoked.","evidence":"crypto: fix memory leak if certificate is revoked","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.8.2 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"4.8.2","evidence":"Node.js 4.8.2 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea3d0514-c3fe-424b-ab99-93da2e2449b6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.8.2","advisory_id":"ea3d0514-c3fe-424b-ab99-93da2e2449b6","event_types":["patch"],"published_at":"2026-10-25T18:05:20.803244+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-04-04T12:43:39+00:00","detail_url":"/events/58477"}]}},{"id":59208,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.10.3 (LTS)","summary":"Node.js 6.10.3 includes fixes for rare TLS segmentation faults and base64 decoding, among other changes.","evidence":"Node.js 6.10.3 (LTS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.10.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.10.3","evidence":"Node.js 6.10.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5d713fa1-a0cc-4e62-b52e-16b76511898d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.10.3","advisory_id":"5d713fa1-a0cc-4e62-b52e-16b76511898d","event_types":["patch"],"published_at":"2026-10-25T18:02:21.90799+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-05-02T18:11:07+00:00","detail_url":"/advisories/advisory%3A5d713fa1-a0cc-4e62-b52e-16b76511898d","group":{"id":"advisory:5d713fa1-a0cc-4e62-b52e-16b76511898d","revision":1,"primary_event_id":58432,"change":"published","superseded_by":[],"changed":{"id":58432,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.10.3 (LTS)","summary":"Node.js 6.10.3 includes fixes for rare TLS segmentation faults and base64 decoding, among other changes.","evidence":"Node.js 6.10.3 (LTS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.10.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.10.3","evidence":"Node.js 6.10.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5d713fa1-a0cc-4e62-b52e-16b76511898d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.10.3","advisory_id":"5d713fa1-a0cc-4e62-b52e-16b76511898d","event_types":["patch"],"published_at":"2026-10-25T18:02:21.90799+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-05-02T18:11:07+00:00","detail_url":"/events/58432"},"members":[{"id":58432,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 6.10.3 (LTS)","summary":"Node.js 6.10.3 includes fixes for rare TLS segmentation faults and base64 decoding, among other changes.","evidence":"Node.js 6.10.3 (LTS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.10.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.10.3","evidence":"Node.js 6.10.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5d713fa1-a0cc-4e62-b52e-16b76511898d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.10.3","advisory_id":"5d713fa1-a0cc-4e62-b52e-16b76511898d","event_types":["patch"],"published_at":"2026-10-25T18:02:21.90799+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-05-02T18:11:07+00:00","detail_url":"/events/58432"}]}}],"next_after":69319,"next_before":59208}