{"schema_version":"1","data":[{"id":61306,"advisory_id":"47f024ed-7d4d-4b76-b2d7-d6219d12c923","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v7.2.0","source_published_at":"2016-11-22T23:48:43+00:00","published_at":"2026-10-25T19:00:27.011566+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2016-9551"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 7.2.0 (Current)","summary":"Node.js 7.2.0 is a security release impacting Windows 10 users. It fixes a potential buffer overflow when writing data to the console on Windows 10.","evidence":"This is a security release impacting Windows 10 users. Notable changes","products":[{"name":{"value":"Node.js","evidence":"Node.js 7.2.0 (Current)"},"prerequisites":[{"value":"Windows 10 users","evidence":"This is a security release impacting Windows 10 users."}],"fixed_versions":[{"value":"7.2.0","evidence":"Node.js 7.2.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2016-9551","product":"Node.js","evidence":"Node.js 7.2.0 (Current) This is a security release impacting Windows 10 users. Notable changes crypto: The Decipher methods setAuthTag() and setAAD now return this. (Kirill Fomichev) #9398 dns: Implemented {ttl: true} for resolve4() and resolve6(). (Ben Noordhuis) #9296 & #9296 libuv: Upgrade to v1.10.1 (cjihrig) #9647 Fixed a potential buffer overflow when writing data to console on Windows 10. (CVE-2016-9551)"}],"related_cves":[{"value":"CVE-2016-9551","evidence":"Fixed a potential buffer overflow when writing data to console on Windows 10. (CVE-2016-9551)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":60239,"advisory_id":"3e67b351-2640-40f0-82d3-1fd615dc8781","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.9.2","source_published_at":"2016-12-06T19:39:44+00:00","published_at":"2026-10-25T18:44:22.275591+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.9.2 (LTS)","summary":"Node.js 6.9.2 includes a fix for a memory leak during TLS handshakes.","evidence":"tls: fix memory leak when writing data to TLSWrap instance during handshake","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.9.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.9.2","evidence":"Node.js 6.9.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":60164,"advisory_id":"ef860003-72fe-4d3c-81dc-5b605a08bd95","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.7.0","source_published_at":"2016-12-06T20:16:34+00:00","published_at":"2026-10-25T18:43:24.353699+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 4.7.0 (LTS)","summary":"Node.js 4.7.0 includes a TLS memory leak fix and other changes. The announcement does not identify a security vulnerability or CVE.","evidence":"tls: fix memory leak when writing data to TLSWrap instance during handshake (Fedor Indutny) #9586","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.7.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.7.0","evidence":"Node.js 4.7.0 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":59383,"advisory_id":"f4914dc8-3998-4b89-a213-649588824c0b","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.9.5","source_published_at":"2017-02-01T00:56:04+00:00","published_at":"2026-10-25T18:27:30.063108+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.9.5 (LTS)","summary":"Node.js 6.9.5 upgrades its OpenSSL sources to 1.0.2k. The announcement does not identify a CVE or explicitly characterize the update as a security fix.","evidence":"deps: upgrade openssl sources to 1.0.2k","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.9.5 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.9.5","evidence":"Node.js 6.9.5 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":59377,"advisory_id":"41217b71-1b3c-4fc9-9074-1f0904d3291a","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.7.3","source_published_at":"2017-02-01T01:04:43+00:00","published_at":"2026-10-25T18:27:24.058683+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 4.7.3 (LTS)","summary":"Node.js 4.7.3 updates its OpenSSL sources to 1.0.2k.","evidence":"deps: upgrade openssl sources to 1.0.2k","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.7.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.7.3","evidence":"Node.js 4.7.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":58835,"advisory_id":"34e2e782-2c4a-47ca-b98b-fc30adbdcad3","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v7.7.0","source_published_at":"2017-03-01T03:05:14+00:00","published_at":"2026-10-25T18:17:37.28724+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["other"],"payload":{"kind":"other","title":"Node.js 7.7.0 release warns that native modules cannot load","summary":"Node.js 7.7.0 contains a bug that prevents native modules from loading; a patch release was expected shortly. No security vulnerability or fix is stated.","evidence":"This release contains a bug that will prevent all native modules from loading. A patch release (7.7.1) will be coming shortly.","products":[{"name":{"value":"Node.js","evidence":"Node.js 7.7.0 (Current)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"7.7.0","evidence":"Node.js 7.7.0 (Current)"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":58503,"advisory_id":"9f57e926-5ccb-40b1-8f4d-45cc74dfb857","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.10.2","source_published_at":"2017-04-04T12:36:54+00:00","published_at":"2026-10-25T18:08:33.302482+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.10.2 (LTS)","summary":"Node.js 6.10.2 includes a fix for a crypto memory leak when a certificate is revoked.","evidence":"crypto: fix memory leak if certificate is revoked","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.10.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.10.2","evidence":"Node.js 6.10.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":58477,"advisory_id":"ea3d0514-c3fe-424b-ab99-93da2e2449b6","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.8.2","source_published_at":"2017-04-04T12:43:39+00:00","published_at":"2026-10-25T18:05:20.803244+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 4.8.2 (Maintenance)","summary":"Node.js 4.8.2 fixes a memory leak when a certificate is revoked.","evidence":"crypto: fix memory leak if certificate is revoked","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.8.2 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"4.8.2","evidence":"Node.js 4.8.2 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":58432,"advisory_id":"5d713fa1-a0cc-4e62-b52e-16b76511898d","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.10.3","source_published_at":"2017-05-02T18:11:07+00:00","published_at":"2026-10-25T18:02:21.90799+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.10.3 (LTS)","summary":"Node.js 6.10.3 includes fixes for rare TLS segmentation faults and base64 decoding, among other changes.","evidence":"Node.js 6.10.3 (LTS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.10.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.10.3","evidence":"Node.js 6.10.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":58406,"advisory_id":"f9733893-7eb6-4b88-a553-504d1ec7c257","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.8.3","source_published_at":"2017-05-02T18:11:20+00:00","published_at":"2026-10-25T17:58:21.264432+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 4.8.3 (Maintenance)","summary":"Node.js 4.8.3 includes fixes for a rare TLS segmentation fault and base64 decoding edge case.","evidence":"tls: fix rare segmentation faults when using TLS","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.8.3 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"4.8.3","evidence":"Node.js 4.8.3 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":58185,"advisory_id":"1d9f8e83-2b10-4227-82c8-c534691df429","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.1.4","source_published_at":"2017-07-11T17:01:31+00:00","published_at":"2026-10-25T17:42:24.926819+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2017-1000381"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 8.1.4 (Current)","summary":"Node.js 8.1.4 disables V8 snapshots to address hash-seed collision risk and includes a c-ares patch for CVE-2017-1000381, which checks that NAPTR records contain required data before processing.","evidence":"Node.js 8.1.4 (Current) Notable changes build: Disable V8 snapshots - The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found (Ali Ijaz Sheikh) deps: CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.1.4 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"8.1.4","evidence":"Node.js 8.1.4 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2017-1000381","product":"Node.js","evidence":"Node.js 8.1.4 (Current) Notable changes build: Disable V8 snapshots - The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found (Ali Ijaz Sheikh) deps: CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record."}],"related_cves":[{"value":"CVE-2017-1000381","evidence":"deps: CVE-2017-1000381"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":58109,"advisory_id":"d5d16605-1fc0-4ee5-8f91-90b7c9e84b49","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2017-security-releases","source_published_at":"2017-07-11T17:00:00+00:00","published_at":"2026-10-25T17:37:33.873005+00:00","extraction_method":"llm","technologies":["c-ares","node-js","nodejs"],"cve_ids":["CVE-2017-1000381","CVE-2017-11499"],"event_types":["patch"],"payload":{"kind":"patch","title":"Security updates for all active release lines, July 2017","summary":"Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.","evidence":"Updates are now available for all active Node.js release lines as well as the 7.x line.","products":[{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[],"fixed_versions":[{"value":"8.3.0","evidence":"The vulnerability has been patched upstream and snapshots have been re-enabled in 8.3.0"}],"affected_versions":[{"value":"4.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"6.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"7.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"8.x","evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},{"value":"0.10.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."},{"value":"0.12.x","evidence":"The 0.10.x and 0.12.x release lines are also vulnerable to the Constant Hashtable Seeds vulnerability."}]},{"name":{"value":"Node.js","evidence":"Node.js-specific security flaws"},"prerequisites":[{"value":"the auth field of the options object used with http.get() to be set to a number","evidence":"Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string."}],"fixed_versions":[],"affected_versions":[{"value":"4.x","evidence":"This is a low severity defect and only applies to the 4.x release line."}]},{"name":{"value":"c-ares","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"all versions of Node.js","evidence":"A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js."}]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2017-11499","evidence":"Constant Hashtable Seeds (CVE-2017-11499)"},{"value":"CVE-2017-1000381","evidence":"CVE-2017-1000381 - c-ares NAPTR parser out of bounds access"}],"security_relevant":true,"severity_evidence":"This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line."},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":57871,"advisory_id":"c946ca67-95f2-4989-930e-68eae41bcfe5","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.11.2","source_published_at":"2017-08-01T07:14:18+00:00","published_at":"2026-10-25T17:31:30.044401+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.11.2 (LTS)","summary":"Node.js 6.11.2 updates OpenSSL and root certificates, among other changes. The announcement does not identify a specific security issue or CVE.","evidence":"Node.js 6.11.2 (LTS)","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.11.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.11.2","evidence":"Node.js 6.11.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":57679,"advisory_id":"78cbb9e9-8f58-4548-ae4c-ce5b369312b5","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/september-2017-path-validation","source_published_at":"2017-09-29T20:09:00+00:00","published_at":"2026-10-25T17:23:35.163903+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2017-14849"],"event_types":["patch"],"payload":{"kind":"patch","title":"Path Validation Vulnerability, September 2017","summary":"Node.js 8.5.0 was vulnerable to a path validation issue that could let an attacker access unintended file system paths. The issue was resolved in a new Node.js 8.x release by partially reverting a change.","evidence":"The Node.js project released a new version of 8.x this week which incorporates a security fix.","products":[{"name":{"value":"Node.js","evidence":"Version 8.5.0 of Node.js is vulnerable."},"prerequisites":[],"fixed_versions":[{"value":"8.x","evidence":"The Node.js project released a new version of 8.x this week which incorporates a security fix."}],"affected_versions":[{"value":"8.5.0","evidence":"Version 8.5.0 of Node.js is vulnerable."}]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2017-14849","product":"Node.js","evidence":"This problem was resolved within Node.js by partially reverting https://github.com/nodejs/node/commit/b98e8d995efb426bbdee56ce503017bdcbbc6332. A CVE has been assigned as CVE-2017-14849"}],"related_cves":[{"value":"CVE-2017-14849","evidence":"A CVE has been assigned as CVE-2017-14849"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":57299,"advisory_id":"2de0b07d-11c3-4bfd-9bce-debda716a00b","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-november-2017","source_published_at":"2017-10-30T23:30:01+00:00","published_at":"2026-10-25T17:08:23.858703+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2017-3735","CVE-2017-3736"],"event_types":["patch"],"payload":{"kind":"patch","title":"OpenSSL update, 1.0.2m","summary":"Node.js releases for active lines include the OpenSSL 1.0.2m update, addressing OpenSSL security flaws. The announcement says the impact is low and does not classify these as strictly security releases.","evidence":"Node v4.8.6 \"Argon\" (Maintenance LTS) Node v6.12.0 \"Boron\" (Active LTS) Node v8.9.1 \"Carbon\" (Active LTS) Node v9.1.0 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js Releases"},"prerequisites":[],"fixed_versions":[{"value":"v4.8.6","evidence":"Node v4.8.6 \"Argon\" (Maintenance LTS)"},{"value":"v6.12.0","evidence":"Node v6.12.0 \"Boron\" (Active LTS)"},{"value":"v8.9.1","evidence":"Node v8.9.1 \"Carbon\" (Active LTS)"},{"value":"v9.1.0","evidence":"Node v9.1.0 (Current)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"each including the OpenSSL 1.0.2m update."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2m","evidence":"each including the OpenSSL 1.0.2m update."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2017-3735","evidence":"CVE-2017-3735: OOB read parsing IPAdressFamily in an X.509 certificate"},{"value":"CVE-2017-3736","evidence":"CVE-2017-3736: Carry propagating bug in the x86_64 Montgomery squaring procedure"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":57224,"advisory_id":"14768c71-a3aa-4478-98b8-486a7171dab0","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.8.6","source_published_at":"2017-11-07T17:26:46+00:00","published_at":"2026-10-25T17:05:22.305217+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 4.8.6 (Maintenance)","summary":"Node.js 4.8.6 updates root certificates and upgrades its OpenSSL sources to 1.0.2m.","evidence":"Node.js 4.8.6 (Maintenance)","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.8.6 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"4.8.6","evidence":"Node.js 4.8.6 (Maintenance)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":57142,"advisory_id":"fadbb709-299e-45a5-986b-cf7477a0a72b","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v9.1.0","source_published_at":"2017-11-07T18:10:51+00:00","published_at":"2026-10-25T17:03:28.441464+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 9.1.0 (Current)","summary":"Node.js 9.1.0 includes an OpenSSL upgrade to 1.0.2m and fixes an HTTP 'connect' event handler leak.","evidence":"Node.js 9.1.0 (Current) Notable Changes CLI: NODE_OPTIONS now supports the --stack-trace-limit option. #16495 deps: OpenSSL is upgraded to 1.0.2m #16691 http: A 'connect' event handler leak has been fixed. #16725","products":[{"name":{"value":"Node.js","evidence":"Node.js 9.1.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"9.1.0","evidence":"Node.js 9.1.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":57004,"advisory_id":"289411c1-0f1e-4744-a151-23148c399a6f","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.9.1","source_published_at":"2017-11-07T22:43:02+00:00","published_at":"2026-10-25T16:55:52.742235+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 8.9.1 (LTS)","summary":"Node.js 8.9.1 updates its OpenSSL sources to 1.0.2m. The announcement does not explicitly identify a security issue or CVE.","evidence":"openssl: upgrade openssl sources to 1.0.2m","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.9.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.9.1","evidence":"Node.js 8.9.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":56735,"advisory_id":"bf0f2a49-b241-4c22-9b43-97187810d3a6","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.12.2","source_published_at":"2017-12-08T16:14:06+00:00","published_at":"2026-10-25T16:48:22.401462+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.12.2 (LTS)","summary":"Node.js 6.12.2 updates its bundled OpenSSL sources to 1.0.2n.","evidence":"deps: openssl updated to 1.0.2n","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.12.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.12.2","evidence":"Node.js 6.12.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":56710,"advisory_id":"a8511b8c-ec84-4e75-83b2-50239037caca","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.9.3","source_published_at":"2017-12-08T16:14:14+00:00","published_at":"2026-10-25T16:46:23.788402+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 8.9.3 (LTS)","summary":"Node.js 8.9.3 (LTS) updates its bundled OpenSSL sources to 1.0.2n and changes buffers allocated with invalid content to be zero-filled.","evidence":"deps: openssl updated to 1.0.2n (Shigeki Ohtsu) #17526","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.9.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.9.3","evidence":"Node.js 8.9.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":56709,"advisory_id":"1f8bcfa9-0272-4278-9285-1056b2c73afb","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v9.2.1","source_published_at":"2017-12-08T16:23:09+00:00","published_at":"2026-10-25T16:46:23.347412+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 9.2.1 (Current)","summary":"Node.js 9.2.1 updates its bundled OpenSSL sources to 1.0.2n and changes buffers allocated with invalid content to be zero-filled.","evidence":"deps: upgrade openssl sources to 1.0.2n (Shigeki Ohtsu) #17526","products":[{"name":{"value":"Node.js","evidence":"Node.js 9.2.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"9.2.1","evidence":"Node.js 9.2.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":56346,"advisory_id":"4ff8bdfe-b374-47b0-9151-9788ebbb20e5","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/jan-2018-spectre-meltdown","source_published_at":"2018-01-08T17:30:00+00:00","published_at":"2026-10-25T16:34:22.39622+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":[],"event_types":["other"],"payload":{"kind":"other","title":"Meltdown and Spectre - Impact On Node.js","summary":"The announcement says the risk to Node.js systems comes from the operating system, not the Node.js runtime. Apply operating-system security patches; no Node.js runtime update is needed.","evidence":"The risk from these attacks to systems running Node.js resides in the systems in which your Node.js applications run, as opposed to the Node.js runtime itself.","products":[{"name":{"value":"Node.js","evidence":"systems running Node.js"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":54932,"advisory_id":"91dd78bc-768d-46f7-928e-f07460897366","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.14.3","source_published_at":"2018-06-12T23:51:52+00:00","published_at":"2026-10-25T15:27:27.016204+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-7167"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.14.3 (LTS)","summary":"Node.js 6.14.3 fixes a denial-of-service vulnerability involving Buffer.fill() hanging.","evidence":"buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.14.3 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.14.3","evidence":"Node.js 6.14.3 (LTS)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2018-7167","product":"Node.js","evidence":"Node.js 6.14.3 (LTS) Notable Changes buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang"}],"related_cves":[{"value":"CVE-2018-7167","evidence":"buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":54457,"advisory_id":"8bba149b-c064-4af8-81ab-4054a13911a9","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.5.0","source_published_at":"2018-06-20T18:48:28+00:00","published_at":"2026-10-25T15:19:26.762215+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-0732"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.5.0 (Current)","summary":"Node.js 10.5.0 includes an OpenSSL dependency update referencing CVE-2018-0732.","evidence":"[e4a7e0d28b] - deps: float ea7abee from openssl / CVE-2018-0732 (Rod Vagg)","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.5.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"10.5.0","evidence":"Node.js 10.5.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-0732","evidence":"deps: float ea7abee from openssl / CVE-2018-0732"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":52196,"advisory_id":"3f6ad6e2-f900-43f0-9a6d-4c982ef9a01e","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.15.1","source_published_at":"2018-12-03T14:13:12+00:00","published_at":"2026-10-25T14:40:23.492321+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-12122"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.15.1 (LTS)","summary":"Node.js 6.15.1 corrects a backport issue related to the Slowloris HTTP denial-of-service fix. Users of Node.js 6.x LTS 'Boron' are advised to upgrade.","evidence":"This is a patch release to address a bad backport of the fix for \"Slowloris HTTP Denial of Service\" (CVE-2018-12122).","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.15.1","evidence":"Node.js 6.15.1 (LTS)"}],"affected_versions":[{"value":"6.15.0","evidence":"Node.js 6.15.0 misapplies the headers timeout to an entire keep-alive HTTP session"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-12122","evidence":"\"Slowloris HTTP Denial of Service\" (CVE-2018-12122)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":51926,"advisory_id":"548fc980-6840-4bc0-bafd-a890ea2cfce9","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases","source_published_at":"2018-11-28T00:55:46+00:00","published_at":"2026-10-25T14:34:29.804197+00:00","extraction_method":"llm","technologies":["node-js-10","node-js-11","node-js-6","node-js-8","nodejs"],"cve_ids":["CVE-2018-0734","CVE-2018-0735","CVE-2018-12116","CVE-2018-12120","CVE-2018-12121","CVE-2018-12122","CVE-2018-12123","CVE-2018-5407"],"event_types":["patch"],"payload":{"kind":"patch","title":"November 2018 Security Releases","summary":"Node.js security releases address multiple vulnerabilities across active release lines. Upgrade to the listed release versions; OpenSSL dependencies are also updated in Node.js 6, 8, 10 and 11.","evidence":"Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement (below).","products":[{"name":{"value":"Node.js 11","evidence":"Node.js 11.3.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"11.3.0","evidence":"Node.js 11.3.0 (Current)"}],"affected_versions":[{"value":"All versions of Node.js 11","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"Node.js 10","evidence":"Node.js 10.14.0 (LTS \"Dubnium\")"},"prerequisites":[],"fixed_versions":[{"value":"10.14.0","evidence":"Node.js 10.14.0 (LTS \"Dubnium\")"}],"affected_versions":[{"value":"All versions of Node.js 10","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"}]},{"name":{"value":"Node.js 8","evidence":"Node.js 8.14.0 (LTS \"Carbon\")"},"prerequisites":[],"fixed_versions":[{"value":"8.14.0","evidence":"Node.js 8.14.0 (LTS \"Carbon\")"}],"affected_versions":[{"value":"All versions of Node.js 8","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"}]},{"name":{"value":"Node.js 6","evidence":"Node.js 6.15.0 (LTS \"Boron\")"},"prerequisites":[],"fixed_versions":[{"value":"6.15.0","evidence":"Node.js 6.15.0 (LTS \"Boron\")"},{"value":"6.15.1","evidence":"Node.js 6.15.1 (LTS \"Boron\") was released to fix a misapplied backport"}],"affected_versions":[{"value":"All versions of Node.js 6","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"}]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-12120","evidence":"Debugger port 5858 listens on any interface by default (CVE-2018-12120)"},{"value":"CVE-2018-12121","evidence":"Denial of Service with large HTTP headers (CVE-2018-12121)"},{"value":"CVE-2018-12122","evidence":"\"Slowloris\" HTTP Denial of Service (CVE-2018-12122)"},{"value":"CVE-2018-12123","evidence":"Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)"},{"value":"CVE-2018-12116","evidence":"HTTP request splitting (CVE-2018-12116)"},{"value":"CVE-2018-0735","evidence":"OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)"},{"value":"CVE-2018-0734","evidence":"OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)"},{"value":"CVE-2018-5407","evidence":"OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":51922,"advisory_id":"688cca60-6c21-4c0c-97d3-9733a8291cca","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.0.0","source_published_at":"2019-04-23T17:01:07+00:00","published_at":"2026-10-25T14:32:00.335389+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2018-0735"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.0.0 (Current)","summary":"Node.js 12.0.0 includes changes described as hardening validation in Buffer, child_process, and fs, along with updates to bundled dependencies. The announcement does not identify these changes as security fixes or state that a CVE is addressed.","evidence":"Node.js 12.0.0 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.0.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"12.0.0","evidence":"Node.js 12.0.0 (Current)"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2018-0735","evidence":"deps: float 99540ec from openssl (CVE-2018-0735)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":51190,"advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","source_published_at":"2019-02-28T12:47:20+00:00","published_at":"2026-10-25T14:19:53.423486+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50938,"advisory_id":"6094c592-f6d3-476e-9031-4ff22a56c073","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v10.15.2","source_published_at":"2019-02-28T12:47:33+00:00","published_at":"2026-10-25T14:15:22.088505+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 10.15.2 (LTS)","summary":"Node.js 10.15.2 addresses a Slowloris HTTP denial-of-service vulnerability by applying the receive timeout consistently to keep-alive connections.","evidence":"This is a security release.","products":[{"name":{"value":"Node.js","evidence":"Node.js 10.15.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"10.15.2","evidence":"Node.js 10.15.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50870,"advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","source_published_at":"2019-02-28T12:47:28+00:00","published_at":"2026-10-25T14:14:02.756652+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":61306,"next_before":50870}