{"schema_version":"1","data":[{"id":51190,"advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","source_published_at":"2019-02-28T12:47:20+00:00","published_at":"2026-10-25T14:19:53.423486+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50870,"advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","source_published_at":"2019-02-28T12:47:28+00:00","published_at":"2026-10-25T14:14:02.756652+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50634,"advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","source_published_at":"2019-02-28T12:53:26+00:00","published_at":"2026-10-25T14:10:27.337042+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"event_types":["patch"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":48097,"advisory_id":"433221a7-925a-44db-a1b9-7737a4360664","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/september-2019-openssl-updates","source_published_at":"2019-09-05T15:34:35+00:00","published_at":"2026-10-25T13:27:30.753402+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":[],"event_types":["advisory"],"payload":{"kind":"advisory","title":"OpenSSL security releases may require Node.js security releases","summary":"OpenSSL planned security releases affecting versions used by Node.js active release lines. The Node.js project had not yet determined whether immediate Node.js security releases were needed.","evidence":"The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"v8.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v10.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v12.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."}]},{"name":{"value":"OpenSSL","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2t","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},{"value":"1.1.1d","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."}],"affected_versions":[]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":41324,"advisory_id":"f22ba73e-66ab-40c2-8e6a-927a472e85be","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/january-2021-security-releases","source_published_at":"2021-01-04T19:30:00+00:00","published_at":"2026-10-25T11:17:46.926244+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2020-1971","CVE-2020-8265","CVE-2020-8287"],"event_types":["patch"],"payload":{"kind":"patch","title":"January 2021 Security Releases","summary":"Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versions.","evidence":"Security releases available Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.23.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v10.23.1 (LTS)","evidence":"Node.js v10.23.1 (LTS)"},{"value":"Node.js v12.20.1 (LTS)","evidence":"Node.js v12.20.1 (LTS)"},{"value":"Node.js v14.15.4 (LTS)","evidence":"Node.js v14.15.4 (LTS)"},{"value":"Node.js v15.5.1 (Current)","evidence":"Node.js v15.5.1 (Current)"}],"affected_versions":[{"value":"All versions of the 15.x, 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"All versions of the 14.x, 12.x and 10.x release lines","evidence":"Impacts: All versions of the 14.x, 12.x and 10.x release lines"},{"value":"Versions of the 15.x line before 15.5.0","evidence":"Versions of the 15.x line before 15.5.0 which included an update to the latest OpenSSL."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8265","evidence":"use-after-free in TLSWrap (High) (CVE-2020-8265)"},{"value":"CVE-2020-8287","evidence":"HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)"},{"value":"CVE-2020-1971","evidence":"OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":33187,"advisory_id":"b9db791b-4a2b-4269-8a41-50ca0cc69f20","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/mar-2022-security-releases","source_published_at":"2022-03-18T01:52:00+00:00","published_at":"2026-10-25T09:01:30.031691+00:00","extraction_method":"llm","technologies":["node-js","nodejs","openssl"],"cve_ids":["CVE-2022-0778"],"event_types":["patch"],"payload":{"kind":"patch","title":"OpenSSL security releases require Node.js security releases","summary":"Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.","evidence":"Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v12.22.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"v12.22.11","evidence":"Node.js v12.22.11 (LTS)"},{"value":"v14.19.1","evidence":"Node.js v14.19.1 (LTS)"},{"value":"v16.14.2","evidence":"Node.js v16.14.2 (LTS)"},{"value":"v17.7.2","evidence":"Node.js v17.7.2 (Current)"}],"affected_versions":[{"value":"17.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"16.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"14.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"12.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."}]},{"name":{"value":"OpenSSL","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"},"prerequisites":[],"fixed_versions":[{"value":"3.0.2n","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"},{"value":"1.1.1n","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"}],"affected_versions":[]}],"severity":"high","related_cves":[{"value":"CVE-2022-0778","evidence":"(High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates."}],"security_relevant":true,"severity_evidence":"The 17.x release line of Node.js is vulnerable to one High severity issue."},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"context_update":false}],"next_after":51190,"next_before":33187}