{"schema_version":"1","data":[{"id":39735,"advisory_id":"f1b56b83-428e-48cd-81a5-4f8f788835e1","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/april-2021-security-releases","source_published_at":"2021-04-06T20:51:00+00:00","published_at":"2026-10-25T10:51:27.041456+00:00","extraction_method":"llm","technologies":["node-js","nodejs","npm"],"cve_ids":["CVE-2020-7774","CVE-2021-3449","CVE-2021-3450"],"event_types":["patch"],"payload":{"kind":"patch","title":"April 2021 Security Releases","summary":"Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.","evidence":"Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.24.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"v10.24.1","evidence":"Node.js v10.24.1 (LTS)"},{"value":"v12.22.1","evidence":"Node.js v12.22.1 (LTS)"},{"value":"v14.16.1","evidence":"Node.js v14.16.1 (LTS)"},{"value":"v15.14.0","evidence":"Node.js v15.14.0 (Current)"}],"affected_versions":[{"value":"All versions of the 15.x, 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]},{"name":{"value":"npm","evidence":"npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"All versions of the 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 14.x, 12.x and 10.x releases lines"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3450","evidence":"CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)"},{"value":"CVE-2021-3449","evidence":"NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)"},{"value":"CVE-2020-7774","evidence":"Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":36712,"advisory_id":"89a9137c-d3e4-4f53-8b7c-f765ac5869ab","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2","source_published_at":"2021-08-31T16:00:00+00:00","published_at":"2026-10-25T10:00:24.980213+00:00","extraction_method":"llm","technologies":["node-js","nodejs","npm"],"cve_ids":["CVE-2021-32803","CVE-2021-32804","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713"],"event_types":["patch"],"payload":{"kind":"patch","title":"August 31 2021 Security Releases","summary":"Security updates for Node.js 12.x and 14.x address vulnerabilities in node-tar and other issues. The announcement lists Node.js v12.22.6 and v14.17.6 as releases.","evidence":"Security releases available Updates are now available for v14.x, and v12.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"v12.22.6","evidence":"Node.js v12.22.6 (LTS)"},{"value":"v14.17.6","evidence":"Node.js v14.17.6 (LTS)"}],"affected_versions":[{"value":"14.x","evidence":"The 14.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues"},{"value":"12.x","evidence":"The 12.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues"}]},{"name":{"value":"npm","evidence":"npm 6 update - node-tar"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"npm 6","evidence":"npm 6 update - node-tar"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-37701","evidence":"CVE-2021-37701"},{"value":"CVE-2021-37712","evidence":"CVE-2021-37712"},{"value":"CVE-2021-37713","evidence":"CVE-2021-37713"},{"value":"CVE-2021-32803","evidence":"CVE-2021-32803"},{"value":"CVE-2021-32804","evidence":"CVE-2021-32804"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":36619,"advisory_id":"ce78b00e-2dfe-4e2a-b389-5abbd223cec6","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.22.6","source_published_at":"2021-08-31T15:03:32+00:00","published_at":"2026-10-25T09:58:21.025599+00:00","extraction_method":"llm","technologies":["node-js","nodejs","npm"],"cve_ids":["CVE-2021-32803","CVE-2021-32804","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713","CVE-2021-39134","CVE-2021-39135"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 12.22.6 (LTS)","summary":"Node.js 12.22.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including issues associated with five listed CVEs.","evidence":"These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804.","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.22.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.22.6","evidence":"Node.js 12.22.6 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"deps: upgrade npm to 6.14.15"},"prerequisites":[],"fixed_versions":[{"value":"6.14.15","evidence":"deps: upgrade npm to 6.14.15"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-32803","evidence":"node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804"},{"value":"CVE-2021-32804","evidence":"node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804"},{"value":"CVE-2021-37701","evidence":"CVE-2021-37701"},{"value":"CVE-2021-37712","evidence":"CVE-2021-37712"},{"value":"CVE-2021-37713","evidence":"CVE-2021-37713"},{"value":"CVE-2021-39134","evidence":"CVE-2021-39134"},{"value":"CVE-2021-39135","evidence":"CVE-2021-39135"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":39735,"next_before":36619}