{"schema_version":"1","data":[{"id":47088,"advisory_id":"92f2418d-34aa-489d-b443-ac98346d0d39","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/december-2019-security-releases","source_published_at":"2019-12-18T00:23:00+00:00","published_at":"2026-10-25T13:09:24.794163+00:00","extraction_method":"llm","technologies":["node-js","nodejs","npm-cli"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"December 2019 Security Releases","summary":"Node.js security releases update npm to address vulnerabilities involving global binary overwrites, symlinks outside node_modules, and arbitrary file writes. The announcement says all current release lines were affected.","evidence":"These releases update npm to v6.13.4 to address three vulnerabilities described below. All current release lines were affected.","products":[{"name":{"value":"npm CLI","evidence":"Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite."},"prerequisites":[],"fixed_versions":[{"value":"v6.13.4","evidence":"These releases update npm to v6.13.4 to address three vulnerabilities described below."}],"affected_versions":[{"value":"prior to 6.13.4","evidence":"Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite."},{"value":"prior to 6.13.3","evidence":"Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules."}]},{"name":{"value":"Node.js","evidence":"All versions of Node.js are vulnerable including the LTS and current releases:"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v13.4.0","evidence":"Node.js v13.4.0"},{"value":"Node.js v12.14.0","evidence":"Node.js v12.14.0"},{"value":"Node.js v10.18.0","evidence":"Node.js v10.18.0"},{"value":"Node.js v8.17.0","evidence":"Node.js v8.17.0"}],"affected_versions":[{"value":"Node.js 8","evidence":"Node.js 8 (LTS \"Carbon\"), Node.js 10 (LTS \"Dubnium\") , Node.js 12 (LTS \"Erbium\"), and Node.js 13."},{"value":"Node.js 10","evidence":"Node.js 8 (LTS \"Carbon\"), Node.js 10 (LTS \"Dubnium\") , Node.js 12 (LTS \"Erbium\"), and Node.js 13."},{"value":"Node.js 12","evidence":"Node.js 8 (LTS \"Carbon\"), Node.js 10 (LTS \"Dubnium\") , Node.js 12 (LTS \"Erbium\"), and Node.js 13."},{"value":"Node.js 13","evidence":"Node.js 8 (LTS \"Carbon\"), Node.js 10 (LTS \"Dubnium\") , Node.js 12 (LTS \"Erbium\"), and Node.js 13."}]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":47088,"next_before":47088}