{"schema_version":"2","view":"grouped","data":[{"id":66143,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.13 (LTS)","summary":"Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.13 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.13","evidence":"Node.js 0.12.13 will be the final Active-LTS release"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.13","advisory_id":"81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","event_types":["patch"],"published_at":"2026-10-25T20:56:23.154392+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T00:12:07+00:00","detail_url":"/advisories/advisory%3A81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","group":{"id":"advisory:81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","revision":1,"primary_event_id":66513,"change":"published","superseded_by":[],"changed":{"id":66513,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.13 (LTS)","summary":"Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.13 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.13","evidence":"Node.js 0.12.13 will be the final Active-LTS release"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.13","advisory_id":"81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","event_types":["patch"],"published_at":"2026-10-25T20:56:23.154392+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T00:12:07+00:00","detail_url":"/events/66513"},"members":[{"id":66513,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.13 (LTS)","summary":"Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.13 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.13","evidence":"Node.js 0.12.13 will be the final Active-LTS release"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.13","advisory_id":"81d68dd2-9f9f-4be6-b49b-fe3ab0074dbc","event_types":["patch"],"published_at":"2026-10-25T20:56:23.154392+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T00:12:07+00:00","detail_url":"/events/66513"}]}},{"id":65996,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.2 (LTS)","summary":"Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.2","evidence":"Node.js 4.4.2 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be41122e-0d63-4bba-b57e-c06869f99610","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.2","advisory_id":"be41122e-0d63-4bba-b57e-c06869f99610","event_types":["patch"],"published_at":"2026-10-25T20:54:21.727605+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T01:47:06+00:00","detail_url":"/advisories/advisory%3Abe41122e-0d63-4bba-b57e-c06869f99610","group":{"id":"advisory:be41122e-0d63-4bba-b57e-c06869f99610","revision":1,"primary_event_id":66366,"change":"published","superseded_by":[],"changed":{"id":66366,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.2 (LTS)","summary":"Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.2","evidence":"Node.js 4.4.2 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be41122e-0d63-4bba-b57e-c06869f99610","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.2","advisory_id":"be41122e-0d63-4bba-b57e-c06869f99610","event_types":["patch"],"published_at":"2026-10-25T20:54:21.727605+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T01:47:06+00:00","detail_url":"/events/66366"},"members":[{"id":66366,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 4.4.2 (LTS)","summary":"Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 4.4.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"4.4.2","evidence":"Node.js 4.4.2 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:be41122e-0d63-4bba-b57e-c06869f99610","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v4.4.2","advisory_id":"be41122e-0d63-4bba-b57e-c06869f99610","event_types":["patch"],"published_at":"2026-10-25T20:54:21.727605+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T01:47:06+00:00","detail_url":"/events/66366"}]}},{"id":65115,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.10.0 (Current)","summary":"Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.10.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.10.0","evidence":"Node.js 5.10.0 (Current)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v3.8.3."},"prerequisites":[],"fixed_versions":[{"value":"v3.8.3","evidence":"npm: Upgrade to v3.8.3."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98c4c5be-1a9f-466d-9251-91f40f74b655","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.10.0","advisory_id":"98c4c5be-1a9f-466d-9251-91f40f74b655","event_types":["patch"],"published_at":"2026-10-25T20:53:24.471943+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T03:31:50+00:00","detail_url":"/advisories/advisory%3A98c4c5be-1a9f-466d-9251-91f40f74b655","group":{"id":"advisory:98c4c5be-1a9f-466d-9251-91f40f74b655","revision":1,"primary_event_id":66294,"change":"published","superseded_by":[],"changed":{"id":66294,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.10.0 (Current)","summary":"Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.10.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.10.0","evidence":"Node.js 5.10.0 (Current)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v3.8.3."},"prerequisites":[],"fixed_versions":[{"value":"v3.8.3","evidence":"npm: Upgrade to v3.8.3."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98c4c5be-1a9f-466d-9251-91f40f74b655","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.10.0","advisory_id":"98c4c5be-1a9f-466d-9251-91f40f74b655","event_types":["patch"],"published_at":"2026-10-25T20:53:24.471943+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T03:31:50+00:00","detail_url":"/events/66294"},"members":[{"id":66294,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 5.10.0 (Current)","summary":"Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.","evidence":"This release includes a security update for npm.","products":[{"name":{"value":"Node.js","evidence":"Node.js 5.10.0 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"5.10.0","evidence":"Node.js 5.10.0 (Current)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v3.8.3."},"prerequisites":[],"fixed_versions":[{"value":"v3.8.3","evidence":"npm: Upgrade to v3.8.3."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98c4c5be-1a9f-466d-9251-91f40f74b655","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v5.10.0","advisory_id":"98c4c5be-1a9f-466d-9251-91f40f74b655","event_types":["patch"],"published_at":"2026-10-25T20:53:24.471943+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T03:31:50+00:00","detail_url":"/events/66294"}]}},{"id":62237,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.44 (Maintenance)","summary":"Node.js 0.10.44 updates bundled npm to address an authentication-token leak and disables obsolete EXPORT and LOW OpenSSL ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.44 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.44","evidence":"Node.js 0.10.44 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[{"value":"the command-line interface","evidence":"collect tokens from users of the command-line interface."}],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8f45c327-47c9-4f2f-89f0-2d6b3a937051","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.44","advisory_id":"8f45c327-47c9-4f2f-89f0-2d6b3a937051","event_types":["patch"],"published_at":"2026-10-25T20:52:11.257568+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T04:35:44+00:00","detail_url":"/advisories/advisory%3A8f45c327-47c9-4f2f-89f0-2d6b3a937051","group":{"id":"advisory:8f45c327-47c9-4f2f-89f0-2d6b3a937051","revision":1,"primary_event_id":66233,"change":"published","superseded_by":[],"changed":{"id":66233,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.44 (Maintenance)","summary":"Node.js 0.10.44 updates bundled npm to address an authentication-token leak and disables obsolete EXPORT and LOW OpenSSL ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.44 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.44","evidence":"Node.js 0.10.44 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[{"value":"the command-line interface","evidence":"collect tokens from users of the command-line interface."}],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8f45c327-47c9-4f2f-89f0-2d6b3a937051","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.44","advisory_id":"8f45c327-47c9-4f2f-89f0-2d6b3a937051","event_types":["patch"],"published_at":"2026-10-25T20:52:11.257568+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T04:35:44+00:00","detail_url":"/events/66233"},"members":[{"id":66233,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.44 (Maintenance)","summary":"Node.js 0.10.44 updates bundled npm to address an authentication-token leak and disables obsolete EXPORT and LOW OpenSSL ciphers.","evidence":"This is a security release, upgrading the bundled version of npm due to a credentials leak vulnerability.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.44 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.44","evidence":"Node.js 0.10.44 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"npm: Upgrade to v2.15.1."},"prerequisites":[{"value":"the command-line interface","evidence":"collect tokens from users of the command-line interface."}],"fixed_versions":[{"value":"2.15.1","evidence":"npm: Upgrade to v2.15.1."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8f45c327-47c9-4f2f-89f0-2d6b3a937051","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.44","advisory_id":"8f45c327-47c9-4f2f-89f0-2d6b3a937051","event_types":["patch"],"published_at":"2026-10-25T20:52:11.257568+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-04-01T04:35:44+00:00","detail_url":"/events/66233"}]}},{"id":40101,"cve_ids":["CVE-2020-7774","CVE-2021-3449","CVE-2021-3450"],"payload":{"kind":"patch","title":"April 2021 Security Releases","summary":"Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.","evidence":"Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.24.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"v10.24.1","evidence":"Node.js v10.24.1 (LTS)"},{"value":"v12.22.1","evidence":"Node.js v12.22.1 (LTS)"},{"value":"v14.16.1","evidence":"Node.js v14.16.1 (LTS)"},{"value":"v15.14.0","evidence":"Node.js v15.14.0 (Current)"}],"affected_versions":[{"value":"All versions of the 15.x, 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]},{"name":{"value":"npm","evidence":"npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"All versions of the 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 14.x, 12.x and 10.x releases lines"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3450","evidence":"CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)"},{"value":"CVE-2021-3449","evidence":"NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)"},{"value":"CVE-2020-7774","evidence":"Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f1b56b83-428e-48cd-81a5-4f8f788835e1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/april-2021-security-releases","advisory_id":"f1b56b83-428e-48cd-81a5-4f8f788835e1","event_types":["patch"],"published_at":"2026-10-25T10:51:27.041456+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-04-06T20:51:00+00:00","detail_url":"/advisories/advisory%3Af1b56b83-428e-48cd-81a5-4f8f788835e1","group":{"id":"advisory:f1b56b83-428e-48cd-81a5-4f8f788835e1","revision":1,"primary_event_id":39735,"change":"published","superseded_by":[],"changed":{"id":39735,"cve_ids":["CVE-2020-7774","CVE-2021-3449","CVE-2021-3450"],"payload":{"kind":"patch","title":"April 2021 Security Releases","summary":"Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.","evidence":"Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.24.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"v10.24.1","evidence":"Node.js v10.24.1 (LTS)"},{"value":"v12.22.1","evidence":"Node.js v12.22.1 (LTS)"},{"value":"v14.16.1","evidence":"Node.js v14.16.1 (LTS)"},{"value":"v15.14.0","evidence":"Node.js v15.14.0 (Current)"}],"affected_versions":[{"value":"All versions of the 15.x, 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]},{"name":{"value":"npm","evidence":"npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"All versions of the 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 14.x, 12.x and 10.x releases lines"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3450","evidence":"CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)"},{"value":"CVE-2021-3449","evidence":"NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)"},{"value":"CVE-2020-7774","evidence":"Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f1b56b83-428e-48cd-81a5-4f8f788835e1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/april-2021-security-releases","advisory_id":"f1b56b83-428e-48cd-81a5-4f8f788835e1","event_types":["patch"],"published_at":"2026-10-25T10:51:27.041456+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-04-06T20:51:00+00:00","detail_url":"/events/39735"},"members":[{"id":39735,"cve_ids":["CVE-2020-7774","CVE-2021-3449","CVE-2021-3450"],"payload":{"kind":"patch","title":"April 2021 Security Releases","summary":"Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.","evidence":"Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.24.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"v10.24.1","evidence":"Node.js v10.24.1 (LTS)"},{"value":"v12.22.1","evidence":"Node.js v12.22.1 (LTS)"},{"value":"v14.16.1","evidence":"Node.js v14.16.1 (LTS)"},{"value":"v15.14.0","evidence":"Node.js v15.14.0 (Current)"}],"affected_versions":[{"value":"All versions of the 15.x, 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]},{"name":{"value":"npm","evidence":"npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"All versions of the 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 14.x, 12.x and 10.x releases lines"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-3450","evidence":"CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)"},{"value":"CVE-2021-3449","evidence":"NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)"},{"value":"CVE-2020-7774","evidence":"Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f1b56b83-428e-48cd-81a5-4f8f788835e1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/april-2021-security-releases","advisory_id":"f1b56b83-428e-48cd-81a5-4f8f788835e1","event_types":["patch"],"published_at":"2026-10-25T10:51:27.041456+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-04-06T20:51:00+00:00","detail_url":"/events/39735"}]}},{"id":37039,"cve_ids":["CVE-2021-32803","CVE-2021-32804","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713"],"payload":{"kind":"patch","title":"August 31 2021 Security Releases","summary":"Security updates for Node.js 12.x and 14.x address vulnerabilities in node-tar and other issues. The announcement lists Node.js v12.22.6 and v14.17.6 as releases.","evidence":"Security releases available Updates are now available for v14.x, and v12.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"v12.22.6","evidence":"Node.js v12.22.6 (LTS)"},{"value":"v14.17.6","evidence":"Node.js v14.17.6 (LTS)"}],"affected_versions":[{"value":"14.x","evidence":"The 14.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues"},{"value":"12.x","evidence":"The 12.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues"}]},{"name":{"value":"npm","evidence":"npm 6 update - node-tar"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"npm 6","evidence":"npm 6 update - node-tar"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-37701","evidence":"CVE-2021-37701"},{"value":"CVE-2021-37712","evidence":"CVE-2021-37712"},{"value":"CVE-2021-37713","evidence":"CVE-2021-37713"},{"value":"CVE-2021-32803","evidence":"CVE-2021-32803"},{"value":"CVE-2021-32804","evidence":"CVE-2021-32804"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89a9137c-d3e4-4f53-8b7c-f765ac5869ab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2","advisory_id":"89a9137c-d3e4-4f53-8b7c-f765ac5869ab","event_types":["patch"],"published_at":"2026-10-25T10:00:24.980213+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-08-31T16:00:00+00:00","detail_url":"/advisories/advisory%3A89a9137c-d3e4-4f53-8b7c-f765ac5869ab","group":{"id":"advisory:89a9137c-d3e4-4f53-8b7c-f765ac5869ab","revision":1,"primary_event_id":36712,"change":"published","superseded_by":[],"changed":{"id":36712,"cve_ids":["CVE-2021-32803","CVE-2021-32804","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713"],"payload":{"kind":"patch","title":"August 31 2021 Security Releases","summary":"Security updates for Node.js 12.x and 14.x address vulnerabilities in node-tar and other issues. The announcement lists Node.js v12.22.6 and v14.17.6 as releases.","evidence":"Security releases available Updates are now available for v14.x, and v12.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"v12.22.6","evidence":"Node.js v12.22.6 (LTS)"},{"value":"v14.17.6","evidence":"Node.js v14.17.6 (LTS)"}],"affected_versions":[{"value":"14.x","evidence":"The 14.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues"},{"value":"12.x","evidence":"The 12.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues"}]},{"name":{"value":"npm","evidence":"npm 6 update - node-tar"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"npm 6","evidence":"npm 6 update - node-tar"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-37701","evidence":"CVE-2021-37701"},{"value":"CVE-2021-37712","evidence":"CVE-2021-37712"},{"value":"CVE-2021-37713","evidence":"CVE-2021-37713"},{"value":"CVE-2021-32803","evidence":"CVE-2021-32803"},{"value":"CVE-2021-32804","evidence":"CVE-2021-32804"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89a9137c-d3e4-4f53-8b7c-f765ac5869ab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2","advisory_id":"89a9137c-d3e4-4f53-8b7c-f765ac5869ab","event_types":["patch"],"published_at":"2026-10-25T10:00:24.980213+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-08-31T16:00:00+00:00","detail_url":"/events/36712"},"members":[{"id":36712,"cve_ids":["CVE-2021-32803","CVE-2021-32804","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713"],"payload":{"kind":"patch","title":"August 31 2021 Security Releases","summary":"Security updates for Node.js 12.x and 14.x address vulnerabilities in node-tar and other issues. The announcement lists Node.js v12.22.6 and v14.17.6 as releases.","evidence":"Security releases available Updates are now available for v14.x, and v12.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js release lines"},"prerequisites":[],"fixed_versions":[{"value":"v12.22.6","evidence":"Node.js v12.22.6 (LTS)"},{"value":"v14.17.6","evidence":"Node.js v14.17.6 (LTS)"}],"affected_versions":[{"value":"14.x","evidence":"The 14.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues"},{"value":"12.x","evidence":"The 12.x release line of Node.js is vulnerable to three high severity issues, and two moderate severity issues"}]},{"name":{"value":"npm","evidence":"npm 6 update - node-tar"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"npm 6","evidence":"npm 6 update - node-tar"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-37701","evidence":"CVE-2021-37701"},{"value":"CVE-2021-37712","evidence":"CVE-2021-37712"},{"value":"CVE-2021-37713","evidence":"CVE-2021-37713"},{"value":"CVE-2021-32803","evidence":"CVE-2021-32803"},{"value":"CVE-2021-32804","evidence":"CVE-2021-32804"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89a9137c-d3e4-4f53-8b7c-f765ac5869ab","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2","advisory_id":"89a9137c-d3e4-4f53-8b7c-f765ac5869ab","event_types":["patch"],"published_at":"2026-10-25T10:00:24.980213+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-08-31T16:00:00+00:00","detail_url":"/events/36712"}]}},{"id":36944,"cve_ids":["CVE-2021-32803","CVE-2021-32804","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713","CVE-2021-39134","CVE-2021-39135"],"payload":{"kind":"patch","title":"Node.js 12.22.6 (LTS)","summary":"Node.js 12.22.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including issues associated with five listed CVEs.","evidence":"These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804.","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.22.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.22.6","evidence":"Node.js 12.22.6 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"deps: upgrade npm to 6.14.15"},"prerequisites":[],"fixed_versions":[{"value":"6.14.15","evidence":"deps: upgrade npm to 6.14.15"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-32803","evidence":"node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804"},{"value":"CVE-2021-32804","evidence":"node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804"},{"value":"CVE-2021-37701","evidence":"CVE-2021-37701"},{"value":"CVE-2021-37712","evidence":"CVE-2021-37712"},{"value":"CVE-2021-37713","evidence":"CVE-2021-37713"},{"value":"CVE-2021-39134","evidence":"CVE-2021-39134"},{"value":"CVE-2021-39135","evidence":"CVE-2021-39135"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce78b00e-2dfe-4e2a-b389-5abbd223cec6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.22.6","advisory_id":"ce78b00e-2dfe-4e2a-b389-5abbd223cec6","event_types":["patch"],"published_at":"2026-10-25T09:58:21.025599+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-08-31T15:03:32+00:00","detail_url":"/advisories/advisory%3Ace78b00e-2dfe-4e2a-b389-5abbd223cec6","group":{"id":"advisory:ce78b00e-2dfe-4e2a-b389-5abbd223cec6","revision":1,"primary_event_id":36619,"change":"published","superseded_by":[],"changed":{"id":36619,"cve_ids":["CVE-2021-32803","CVE-2021-32804","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713","CVE-2021-39134","CVE-2021-39135"],"payload":{"kind":"patch","title":"Node.js 12.22.6 (LTS)","summary":"Node.js 12.22.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including issues associated with five listed CVEs.","evidence":"These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804.","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.22.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.22.6","evidence":"Node.js 12.22.6 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"deps: upgrade npm to 6.14.15"},"prerequisites":[],"fixed_versions":[{"value":"6.14.15","evidence":"deps: upgrade npm to 6.14.15"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-32803","evidence":"node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804"},{"value":"CVE-2021-32804","evidence":"node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804"},{"value":"CVE-2021-37701","evidence":"CVE-2021-37701"},{"value":"CVE-2021-37712","evidence":"CVE-2021-37712"},{"value":"CVE-2021-37713","evidence":"CVE-2021-37713"},{"value":"CVE-2021-39134","evidence":"CVE-2021-39134"},{"value":"CVE-2021-39135","evidence":"CVE-2021-39135"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce78b00e-2dfe-4e2a-b389-5abbd223cec6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.22.6","advisory_id":"ce78b00e-2dfe-4e2a-b389-5abbd223cec6","event_types":["patch"],"published_at":"2026-10-25T09:58:21.025599+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-08-31T15:03:32+00:00","detail_url":"/events/36619"},"members":[{"id":36619,"cve_ids":["CVE-2021-32803","CVE-2021-32804","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713","CVE-2021-39134","CVE-2021-39135"],"payload":{"kind":"patch","title":"Node.js 12.22.6 (LTS)","summary":"Node.js 12.22.6 updates npm to 6.14.15 and remediates vulnerabilities in npm CLI dependencies, including issues associated with five listed CVEs.","evidence":"These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804.","products":[{"name":{"value":"Node.js","evidence":"Node.js 12.22.6 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"12.22.6","evidence":"Node.js 12.22.6 (LTS)"}],"affected_versions":[]},{"name":{"value":"npm","evidence":"deps: upgrade npm to 6.14.15"},"prerequisites":[],"fixed_versions":[{"value":"6.14.15","evidence":"deps: upgrade npm to 6.14.15"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2021-32803","evidence":"node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804"},{"value":"CVE-2021-32804","evidence":"node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804"},{"value":"CVE-2021-37701","evidence":"CVE-2021-37701"},{"value":"CVE-2021-37712","evidence":"CVE-2021-37712"},{"value":"CVE-2021-37713","evidence":"CVE-2021-37713"},{"value":"CVE-2021-39134","evidence":"CVE-2021-39134"},{"value":"CVE-2021-39135","evidence":"CVE-2021-39135"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce78b00e-2dfe-4e2a-b389-5abbd223cec6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v12.22.6","advisory_id":"ce78b00e-2dfe-4e2a-b389-5abbd223cec6","event_types":["patch"],"published_at":"2026-10-25T09:58:21.025599+00:00","technologies":["node-js","nodejs","npm"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-08-31T15:03:32+00:00","detail_url":"/events/36619"}]}}],"next_after":66143,"next_before":36944}