{"schema_version":"2","view":"grouped","data":[{"id":70141,"cve_ids":["CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 0.12.9 (LTS)","summary":"This security release fixes an HTTP pipelining denial-of-service issue and upgrades OpenSSL to 1.0.1q, which fixes CVE-2015-3194.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.9 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.9","evidence":"Node.js 0.12.9 (LTS)"}],"affected_versions":[]},{"name":{"value":"openssl","evidence":"openssl: Upgrade to 1.0.1q"},"prerequisites":[{"value":"Node.js TLS servers using client authentication; TLS clients are also impacted.","evidence":"a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted."}],"fixed_versions":[{"value":"1.0.1q","evidence":"openssl: Upgrade to 1.0.1q"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2015-3194","product":"openssl","evidence":"openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194"}],"related_cves":[{"value":"CVE-2015-3194","evidence":"fixes CVE-2015-3194"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.9","advisory_id":"0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","event_types":["patch"],"published_at":"2026-10-25T22:15:24.787398+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:02:00+00:00","detail_url":"/advisories/advisory%3A0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","group":{"id":"advisory:0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","revision":1,"primary_event_id":70511,"change":"published","superseded_by":[],"changed":{"id":70511,"cve_ids":["CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 0.12.9 (LTS)","summary":"This security release fixes an HTTP pipelining denial-of-service issue and upgrades OpenSSL to 1.0.1q, which fixes CVE-2015-3194.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.9 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.9","evidence":"Node.js 0.12.9 (LTS)"}],"affected_versions":[]},{"name":{"value":"openssl","evidence":"openssl: Upgrade to 1.0.1q"},"prerequisites":[{"value":"Node.js TLS servers using client authentication; TLS clients are also impacted.","evidence":"a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted."}],"fixed_versions":[{"value":"1.0.1q","evidence":"openssl: Upgrade to 1.0.1q"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2015-3194","product":"openssl","evidence":"openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194"}],"related_cves":[{"value":"CVE-2015-3194","evidence":"fixes CVE-2015-3194"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.9","advisory_id":"0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","event_types":["patch"],"published_at":"2026-10-25T22:15:24.787398+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:02:00+00:00","detail_url":"/events/70511"},"members":[{"id":70511,"cve_ids":["CVE-2015-3194"],"payload":{"kind":"patch","title":"Node.js 0.12.9 (LTS)","summary":"This security release fixes an HTTP pipelining denial-of-service issue and upgrades OpenSSL to 1.0.1q, which fixes CVE-2015-3194.","evidence":"This is an important security release. All Node.js users should consult our December Security Release Summary for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.9 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.9","evidence":"Node.js 0.12.9 (LTS)"}],"affected_versions":[]},{"name":{"value":"openssl","evidence":"openssl: Upgrade to 1.0.1q"},"prerequisites":[{"value":"Node.js TLS servers using client authentication; TLS clients are also impacted.","evidence":"a potential denial-of-service vector for Node.js TLS servers using client authentication; TLS clients are also impacted."}],"fixed_versions":[{"value":"1.0.1q","evidence":"openssl: Upgrade to 1.0.1q"}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[{"cve":"CVE-2015-3194","product":"openssl","evidence":"openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194"}],"related_cves":[{"value":"CVE-2015-3194","evidence":"fixes CVE-2015-3194"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.9","advisory_id":"0e6c4b67-48ce-4e19-a3d8-56d4ca96145b","event_types":["patch"],"published_at":"2026-10-25T22:15:24.787398+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2015-12-04T03:02:00+00:00","detail_url":"/events/70511"}]}},{"id":67202,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.11 (LTS)","summary":"Node.js 0.12.11 includes security updates through an OpenSSL upgrade to 1.0.1s, addressing several low-severity defects.","evidence":"This release contains security updates. OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.11","evidence":"Node.js 0.12.11 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:8a10a8dd-3646-4c2a-a905-517156db1266","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.11","advisory_id":"8a10a8dd-3646-4c2a-a905-517156db1266","event_types":["patch"],"published_at":"2026-10-25T21:12:23.121952+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-03T18:07:44+00:00","detail_url":"/advisories/advisory%3A8a10a8dd-3646-4c2a-a905-517156db1266","group":{"id":"advisory:8a10a8dd-3646-4c2a-a905-517156db1266","revision":1,"primary_event_id":67572,"change":"published","superseded_by":[],"changed":{"id":67572,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.11 (LTS)","summary":"Node.js 0.12.11 includes security updates through an OpenSSL upgrade to 1.0.1s, addressing several low-severity defects.","evidence":"This release contains security updates. OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.11","evidence":"Node.js 0.12.11 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:8a10a8dd-3646-4c2a-a905-517156db1266","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.11","advisory_id":"8a10a8dd-3646-4c2a-a905-517156db1266","event_types":["patch"],"published_at":"2026-10-25T21:12:23.121952+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-03T18:07:44+00:00","detail_url":"/events/67572"},"members":[{"id":67572,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.12.11 (LTS)","summary":"Node.js 0.12.11 includes security updates through an OpenSSL upgrade to 1.0.1s, addressing several low-severity defects.","evidence":"This release contains security updates. OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.12.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"0.12.11","evidence":"Node.js 0.12.11 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:8a10a8dd-3646-4c2a-a905-517156db1266","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.12.11","advisory_id":"8a10a8dd-3646-4c2a-a905-517156db1266","event_types":["patch"],"published_at":"2026-10-25T21:12:23.121952+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-03T18:07:44+00:00","detail_url":"/events/67572"}]}},{"id":67160,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.43 (Maintenance)","summary":"Node.js 0.10.43 updates the bundled OpenSSL to 1.0.1s, which includes security fixes, and removes SSLv2 support.","evidence":"This release contains security updates.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.43 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.43","evidence":"Node.js 0.10.43 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"Upgrade from 1.0.1r to 1.0.1s"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:9935675b-3f95-4020-aeb8-6573d3cea4a9","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.43","advisory_id":"9935675b-3f95-4020-aeb8-6573d3cea4a9","event_types":["patch"],"published_at":"2026-10-25T21:11:23.593803+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-04T01:47:40+00:00","detail_url":"/advisories/advisory%3A9935675b-3f95-4020-aeb8-6573d3cea4a9","group":{"id":"advisory:9935675b-3f95-4020-aeb8-6573d3cea4a9","revision":1,"primary_event_id":67530,"change":"published","superseded_by":[],"changed":{"id":67530,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.43 (Maintenance)","summary":"Node.js 0.10.43 updates the bundled OpenSSL to 1.0.1s, which includes security fixes, and removes SSLv2 support.","evidence":"This release contains security updates.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.43 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.43","evidence":"Node.js 0.10.43 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"Upgrade from 1.0.1r to 1.0.1s"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:9935675b-3f95-4020-aeb8-6573d3cea4a9","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.43","advisory_id":"9935675b-3f95-4020-aeb8-6573d3cea4a9","event_types":["patch"],"published_at":"2026-10-25T21:11:23.593803+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-04T01:47:40+00:00","detail_url":"/events/67530"},"members":[{"id":67530,"cve_ids":[],"payload":{"kind":"patch","title":"Node.js 0.10.43 (Maintenance)","summary":"Node.js 0.10.43 updates the bundled OpenSSL to 1.0.1s, which includes security fixes, and removes SSLv2 support.","evidence":"This release contains security updates.","products":[{"name":{"value":"Node.js","evidence":"Node.js 0.10.43 (Maintenance)"},"prerequisites":[],"fixed_versions":[{"value":"0.10.43","evidence":"Node.js 0.10.43 (Maintenance)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js."},"prerequisites":[],"fixed_versions":[{"value":"1.0.1s","evidence":"Upgrade from 1.0.1r to 1.0.1s"}],"affected_versions":[]}],"severity":"low","fixed_cves":[],"related_cves":[],"security_relevant":true,"severity_evidence":"It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users."},"group_id":"advisory:9935675b-3f95-4020-aeb8-6573d3cea4a9","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v0.10.43","advisory_id":"9935675b-3f95-4020-aeb8-6573d3cea4a9","event_types":["patch"],"published_at":"2026-10-25T21:11:23.593803+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-03-04T01:47:40+00:00","detail_url":"/events/67530"}]}},{"id":57794,"cve_ids":["CVE-2017-3735","CVE-2017-3736"],"payload":{"kind":"patch","title":"OpenSSL update, 1.0.2m","summary":"Node.js releases for active lines include the OpenSSL 1.0.2m update, addressing OpenSSL security flaws. The announcement says the impact is low and does not classify these as strictly security releases.","evidence":"Node v4.8.6 \"Argon\" (Maintenance LTS) Node v6.12.0 \"Boron\" (Active LTS) Node v8.9.1 \"Carbon\" (Active LTS) Node v9.1.0 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js Releases"},"prerequisites":[],"fixed_versions":[{"value":"v4.8.6","evidence":"Node v4.8.6 \"Argon\" (Maintenance LTS)"},{"value":"v6.12.0","evidence":"Node v6.12.0 \"Boron\" (Active LTS)"},{"value":"v8.9.1","evidence":"Node v8.9.1 \"Carbon\" (Active LTS)"},{"value":"v9.1.0","evidence":"Node v9.1.0 (Current)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"each including the OpenSSL 1.0.2m update."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2m","evidence":"each including the OpenSSL 1.0.2m update."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2017-3735","evidence":"CVE-2017-3735: OOB read parsing IPAdressFamily in an X.509 certificate"},{"value":"CVE-2017-3736","evidence":"CVE-2017-3736: Carry propagating bug in the x86_64 Montgomery squaring procedure"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2de0b07d-11c3-4bfd-9bce-debda716a00b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-november-2017","advisory_id":"2de0b07d-11c3-4bfd-9bce-debda716a00b","event_types":["patch"],"published_at":"2026-10-25T17:08:23.858703+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-10-30T23:30:01+00:00","detail_url":"/advisories/advisory%3A2de0b07d-11c3-4bfd-9bce-debda716a00b","group":{"id":"advisory:2de0b07d-11c3-4bfd-9bce-debda716a00b","revision":1,"primary_event_id":57299,"change":"published","superseded_by":[],"changed":{"id":57299,"cve_ids":["CVE-2017-3735","CVE-2017-3736"],"payload":{"kind":"patch","title":"OpenSSL update, 1.0.2m","summary":"Node.js releases for active lines include the OpenSSL 1.0.2m update, addressing OpenSSL security flaws. The announcement says the impact is low and does not classify these as strictly security releases.","evidence":"Node v4.8.6 \"Argon\" (Maintenance LTS) Node v6.12.0 \"Boron\" (Active LTS) Node v8.9.1 \"Carbon\" (Active LTS) Node v9.1.0 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js Releases"},"prerequisites":[],"fixed_versions":[{"value":"v4.8.6","evidence":"Node v4.8.6 \"Argon\" (Maintenance LTS)"},{"value":"v6.12.0","evidence":"Node v6.12.0 \"Boron\" (Active LTS)"},{"value":"v8.9.1","evidence":"Node v8.9.1 \"Carbon\" (Active LTS)"},{"value":"v9.1.0","evidence":"Node v9.1.0 (Current)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"each including the OpenSSL 1.0.2m update."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2m","evidence":"each including the OpenSSL 1.0.2m update."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2017-3735","evidence":"CVE-2017-3735: OOB read parsing IPAdressFamily in an X.509 certificate"},{"value":"CVE-2017-3736","evidence":"CVE-2017-3736: Carry propagating bug in the x86_64 Montgomery squaring procedure"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2de0b07d-11c3-4bfd-9bce-debda716a00b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-november-2017","advisory_id":"2de0b07d-11c3-4bfd-9bce-debda716a00b","event_types":["patch"],"published_at":"2026-10-25T17:08:23.858703+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-10-30T23:30:01+00:00","detail_url":"/events/57299"},"members":[{"id":57299,"cve_ids":["CVE-2017-3735","CVE-2017-3736"],"payload":{"kind":"patch","title":"OpenSSL update, 1.0.2m","summary":"Node.js releases for active lines include the OpenSSL 1.0.2m update, addressing OpenSSL security flaws. The announcement says the impact is low and does not classify these as strictly security releases.","evidence":"Node v4.8.6 \"Argon\" (Maintenance LTS) Node v6.12.0 \"Boron\" (Active LTS) Node v8.9.1 \"Carbon\" (Active LTS) Node v9.1.0 (Current)","products":[{"name":{"value":"Node.js","evidence":"Node.js Releases"},"prerequisites":[],"fixed_versions":[{"value":"v4.8.6","evidence":"Node v4.8.6 \"Argon\" (Maintenance LTS)"},{"value":"v6.12.0","evidence":"Node v6.12.0 \"Boron\" (Active LTS)"},{"value":"v8.9.1","evidence":"Node v8.9.1 \"Carbon\" (Active LTS)"},{"value":"v9.1.0","evidence":"Node v9.1.0 (Current)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"each including the OpenSSL 1.0.2m update."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2m","evidence":"each including the OpenSSL 1.0.2m update."}],"affected_versions":[]}],"severity":"unknown","fixed_cves":[],"related_cves":[{"value":"CVE-2017-3735","evidence":"CVE-2017-3735: OOB read parsing IPAdressFamily in an X.509 certificate"},{"value":"CVE-2017-3736","evidence":"CVE-2017-3736: Carry propagating bug in the x86_64 Montgomery squaring procedure"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2de0b07d-11c3-4bfd-9bce-debda716a00b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-november-2017","advisory_id":"2de0b07d-11c3-4bfd-9bce-debda716a00b","event_types":["patch"],"published_at":"2026-10-25T17:08:23.858703+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2017-10-30T23:30:01+00:00","detail_url":"/events/57299"}]}},{"id":51662,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:385337ca-2a37-4205-b989-98fc48aaf927","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","event_types":["patch"],"published_at":"2026-10-25T14:19:53.423486+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:20+00:00","detail_url":"/advisories/advisory%3A385337ca-2a37-4205-b989-98fc48aaf927","group":{"id":"advisory:385337ca-2a37-4205-b989-98fc48aaf927","revision":1,"primary_event_id":51190,"change":"published","superseded_by":[],"changed":{"id":51190,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:385337ca-2a37-4205-b989-98fc48aaf927","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","event_types":["patch"],"published_at":"2026-10-25T14:19:53.423486+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:20+00:00","detail_url":"/events/51190"},"members":[{"id":51190,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"Node.js 6.17.0 (LTS)","summary":"Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary","products":[{"name":{"value":"Node.js","evidence":"Node.js 6.17.0 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"6.17.0","evidence":"Node.js 6.17.0 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5739","evidence":"CVE-2019-5739"},{"value":"CVE-2019-5737","evidence":"CVE-2019-5737"},{"value":"CVE-2019-1559","evidence":"CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:385337ca-2a37-4205-b989-98fc48aaf927","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v6.17.0","advisory_id":"385337ca-2a37-4205-b989-98fc48aaf927","event_types":["patch"],"published_at":"2026-10-25T14:19:53.423486+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:20+00:00","detail_url":"/events/51190"}]}},{"id":51342,"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994776bd-8820-4102-9e7b-5aee22fde0a9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","event_types":["patch"],"published_at":"2026-10-25T14:14:02.756652+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:28+00:00","detail_url":"/advisories/advisory%3A994776bd-8820-4102-9e7b-5aee22fde0a9","group":{"id":"advisory:994776bd-8820-4102-9e7b-5aee22fde0a9","revision":1,"primary_event_id":50870,"change":"published","superseded_by":[],"changed":{"id":50870,"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994776bd-8820-4102-9e7b-5aee22fde0a9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","event_types":["patch"],"published_at":"2026-10-25T14:14:02.756652+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:28+00:00","detail_url":"/events/50870"},"members":[{"id":50870,"cve_ids":["CVE-2019-1559","CVE-2019-5737"],"payload":{"kind":"patch","title":"Node.js 8.15.1 (LTS)","summary":"Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.","evidence":"This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js 8.15.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"8.15.1","evidence":"Node.js 8.15.1 (LTS)"}],"affected_versions":[]},{"name":{"value":"OpenSSL","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"},"prerequisites":[],"fixed_versions":[{"value":"1.0.2r","evidence":"OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-1559","evidence":"OpenSSL: 0-byte record padding oracle (CVE-2019-1559)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994776bd-8820-4102-9e7b-5aee22fde0a9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v8.15.1","advisory_id":"994776bd-8820-4102-9e7b-5aee22fde0a9","event_types":["patch"],"published_at":"2026-10-25T14:14:02.756652+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:47:28+00:00","detail_url":"/events/50870"}]}},{"id":51106,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07c9cfd1-8fe4-45c9-be29-9ea600b239c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","event_types":["patch"],"published_at":"2026-10-25T14:10:27.337042+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:53:26+00:00","detail_url":"/advisories/advisory%3A07c9cfd1-8fe4-45c9-be29-9ea600b239c4","group":{"id":"advisory:07c9cfd1-8fe4-45c9-be29-9ea600b239c4","revision":1,"primary_event_id":50634,"change":"published","superseded_by":[],"changed":{"id":50634,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07c9cfd1-8fe4-45c9-be29-9ea600b239c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","event_types":["patch"],"published_at":"2026-10-25T14:10:27.337042+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:53:26+00:00","detail_url":"/events/50634"},"members":[{"id":50634,"cve_ids":["CVE-2019-1559","CVE-2019-5737","CVE-2019-5739"],"payload":{"kind":"patch","title":"February 2019 Security Releases","summary":"Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.","evidence":"Updates are now available for all active Node.js release lines.","products":[{"name":{"value":"Node.js","evidence":"Node.js 11.10.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js 11.10.1","evidence":"Node.js 11.10.1 (Current)"},{"value":"Node.js 10.15.2","evidence":"Node.js 10.15.2 (LTS \"Dubnium\")"},{"value":"Node.js 8.15.1","evidence":"Node.js 8.15.1 (LTS \"Carbon\")"},{"value":"Node.js 6.17.0","evidence":"Node.js 6.17.0 (LTS \"Boron\")"}],"affected_versions":[{"value":"All versions of Node.js 6 (LTS \"Boron\")","evidence":"All versions of Node.js 6 (LTS \"Boron\") are vulnerable"},{"value":"All versions of Node.js 8 (LTS \"Carbon\")","evidence":"All versions of Node.js 8 (LTS \"Carbon\") are vulnerable"},{"value":"All versions of Node.js 10 (LTS \"Dubnium\")","evidence":"All versions of Node.js 10 (LTS \"Dubnium\") are vulnerable"},{"value":"All versions of Node.js 11 (Current)","evidence":"All versions of Node.js 11 (Current) are vulnerable"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"},"prerequisites":[{"value":"included in the releases for Node.js versions 6 and 8 only","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only."}],"fixed_versions":[{"value":"OpenSSL 1.0.2r","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"affected_versions":[{"value":"OpenSSL 1.0.2","evidence":"The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2019-5737","evidence":"Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)"},{"value":"CVE-2019-5739","evidence":"Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)"},{"value":"CVE-2019-1559","evidence":"OpenSSL 1.0.2r contains a fix for CVE-2019-1559"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07c9cfd1-8fe4-45c9-be29-9ea600b239c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases","advisory_id":"07c9cfd1-8fe4-45c9-be29-9ea600b239c4","event_types":["patch"],"published_at":"2026-10-25T14:10:27.337042+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-02-28T12:53:26+00:00","detail_url":"/events/50634"}]}},{"id":48569,"cve_ids":[],"payload":{"kind":"advisory","title":"OpenSSL security releases may require Node.js security releases","summary":"OpenSSL planned security releases affecting versions used by Node.js active release lines. The Node.js project had not yet determined whether immediate Node.js security releases were needed.","evidence":"The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"v8.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v10.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v12.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."}]},{"name":{"value":"OpenSSL","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2t","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},{"value":"1.1.1d","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."}],"affected_versions":[]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:433221a7-925a-44db-a1b9-7737a4360664","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/september-2019-openssl-updates","advisory_id":"433221a7-925a-44db-a1b9-7737a4360664","event_types":["advisory"],"published_at":"2026-10-25T13:27:30.753402+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-09-05T15:34:35+00:00","detail_url":"/advisories/advisory%3A433221a7-925a-44db-a1b9-7737a4360664","group":{"id":"advisory:433221a7-925a-44db-a1b9-7737a4360664","revision":1,"primary_event_id":48097,"change":"published","superseded_by":[],"changed":{"id":48097,"cve_ids":[],"payload":{"kind":"advisory","title":"OpenSSL security releases may require Node.js security releases","summary":"OpenSSL planned security releases affecting versions used by Node.js active release lines. The Node.js project had not yet determined whether immediate Node.js security releases were needed.","evidence":"The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"v8.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v10.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v12.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."}]},{"name":{"value":"OpenSSL","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2t","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},{"value":"1.1.1d","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."}],"affected_versions":[]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:433221a7-925a-44db-a1b9-7737a4360664","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/september-2019-openssl-updates","advisory_id":"433221a7-925a-44db-a1b9-7737a4360664","event_types":["advisory"],"published_at":"2026-10-25T13:27:30.753402+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-09-05T15:34:35+00:00","detail_url":"/events/48097"},"members":[{"id":48097,"cve_ids":[],"payload":{"kind":"advisory","title":"OpenSSL security releases may require Node.js security releases","summary":"OpenSSL planned security releases affecting versions used by Node.js active release lines. The Node.js project had not yet determined whether immediate Node.js security releases were needed.","evidence":"The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"v8.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v10.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."},{"value":"v12.x","evidence":"Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update."}]},{"name":{"value":"OpenSSL","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},"prerequisites":[],"fixed_versions":[{"value":"1.0.2t","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."},{"value":"1.1.1d","evidence":"The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC."}],"affected_versions":[]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:433221a7-925a-44db-a1b9-7737a4360664","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/september-2019-openssl-updates","advisory_id":"433221a7-925a-44db-a1b9-7737a4360664","event_types":["advisory"],"published_at":"2026-10-25T13:27:30.753402+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2019-09-05T15:34:35+00:00","detail_url":"/events/48097"}]}},{"id":41711,"cve_ids":["CVE-2020-1971","CVE-2020-8265","CVE-2020-8287"],"payload":{"kind":"patch","title":"January 2021 Security Releases","summary":"Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versions.","evidence":"Security releases available Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.23.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v10.23.1 (LTS)","evidence":"Node.js v10.23.1 (LTS)"},{"value":"Node.js v12.20.1 (LTS)","evidence":"Node.js v12.20.1 (LTS)"},{"value":"Node.js v14.15.4 (LTS)","evidence":"Node.js v14.15.4 (LTS)"},{"value":"Node.js v15.5.1 (Current)","evidence":"Node.js v15.5.1 (Current)"}],"affected_versions":[{"value":"All versions of the 15.x, 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"All versions of the 14.x, 12.x and 10.x release lines","evidence":"Impacts: All versions of the 14.x, 12.x and 10.x release lines"},{"value":"Versions of the 15.x line before 15.5.0","evidence":"Versions of the 15.x line before 15.5.0 which included an update to the latest OpenSSL."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8265","evidence":"use-after-free in TLSWrap (High) (CVE-2020-8265)"},{"value":"CVE-2020-8287","evidence":"HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)"},{"value":"CVE-2020-1971","evidence":"OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f22ba73e-66ab-40c2-8e6a-927a472e85be","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/january-2021-security-releases","advisory_id":"f22ba73e-66ab-40c2-8e6a-927a472e85be","event_types":["patch"],"published_at":"2026-10-25T11:17:46.926244+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-01-04T19:30:00+00:00","detail_url":"/advisories/advisory%3Af22ba73e-66ab-40c2-8e6a-927a472e85be","group":{"id":"advisory:f22ba73e-66ab-40c2-8e6a-927a472e85be","revision":1,"primary_event_id":41324,"change":"published","superseded_by":[],"changed":{"id":41324,"cve_ids":["CVE-2020-1971","CVE-2020-8265","CVE-2020-8287"],"payload":{"kind":"patch","title":"January 2021 Security Releases","summary":"Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versions.","evidence":"Security releases available Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.23.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v10.23.1 (LTS)","evidence":"Node.js v10.23.1 (LTS)"},{"value":"Node.js v12.20.1 (LTS)","evidence":"Node.js v12.20.1 (LTS)"},{"value":"Node.js v14.15.4 (LTS)","evidence":"Node.js v14.15.4 (LTS)"},{"value":"Node.js v15.5.1 (Current)","evidence":"Node.js v15.5.1 (Current)"}],"affected_versions":[{"value":"All versions of the 15.x, 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"All versions of the 14.x, 12.x and 10.x release lines","evidence":"Impacts: All versions of the 14.x, 12.x and 10.x release lines"},{"value":"Versions of the 15.x line before 15.5.0","evidence":"Versions of the 15.x line before 15.5.0 which included an update to the latest OpenSSL."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8265","evidence":"use-after-free in TLSWrap (High) (CVE-2020-8265)"},{"value":"CVE-2020-8287","evidence":"HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)"},{"value":"CVE-2020-1971","evidence":"OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f22ba73e-66ab-40c2-8e6a-927a472e85be","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/january-2021-security-releases","advisory_id":"f22ba73e-66ab-40c2-8e6a-927a472e85be","event_types":["patch"],"published_at":"2026-10-25T11:17:46.926244+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-01-04T19:30:00+00:00","detail_url":"/events/41324"},"members":[{"id":41324,"cve_ids":["CVE-2020-1971","CVE-2020-8265","CVE-2020-8287"],"payload":{"kind":"patch","title":"January 2021 Security Releases","summary":"Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versions.","evidence":"Security releases available Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v10.23.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v10.23.1 (LTS)","evidence":"Node.js v10.23.1 (LTS)"},{"value":"Node.js v12.20.1 (LTS)","evidence":"Node.js v12.20.1 (LTS)"},{"value":"Node.js v14.15.4 (LTS)","evidence":"Node.js v14.15.4 (LTS)"},{"value":"Node.js v15.5.1 (Current)","evidence":"Node.js v15.5.1 (Current)"}],"affected_versions":[{"value":"All versions of the 15.x, 14.x, 12.x and 10.x releases lines","evidence":"Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines"}]},{"name":{"value":"OpenSSL","evidence":"OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"All versions of the 14.x, 12.x and 10.x release lines","evidence":"Impacts: All versions of the 14.x, 12.x and 10.x release lines"},{"value":"Versions of the 15.x line before 15.5.0","evidence":"Versions of the 15.x line before 15.5.0 which included an update to the latest OpenSSL."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2020-8265","evidence":"use-after-free in TLSWrap (High) (CVE-2020-8265)"},{"value":"CVE-2020-8287","evidence":"HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)"},{"value":"CVE-2020-1971","evidence":"OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f22ba73e-66ab-40c2-8e6a-927a472e85be","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/january-2021-security-releases","advisory_id":"f22ba73e-66ab-40c2-8e6a-927a472e85be","event_types":["patch"],"published_at":"2026-10-25T11:17:46.926244+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2021-01-04T19:30:00+00:00","detail_url":"/events/41324"}]}},{"id":33466,"cve_ids":["CVE-2022-0778"],"payload":{"kind":"patch","title":"OpenSSL security releases require Node.js security releases","summary":"Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.","evidence":"Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v12.22.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"v12.22.11","evidence":"Node.js v12.22.11 (LTS)"},{"value":"v14.19.1","evidence":"Node.js v14.19.1 (LTS)"},{"value":"v16.14.2","evidence":"Node.js v16.14.2 (LTS)"},{"value":"v17.7.2","evidence":"Node.js v17.7.2 (Current)"}],"affected_versions":[{"value":"17.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"16.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"14.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"12.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."}]},{"name":{"value":"OpenSSL","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"},"prerequisites":[],"fixed_versions":[{"value":"3.0.2n","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"},{"value":"1.1.1n","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"}],"affected_versions":[]}],"severity":"high","related_cves":[{"value":"CVE-2022-0778","evidence":"(High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates."}],"security_relevant":true,"severity_evidence":"The 17.x release line of Node.js is vulnerable to one High severity issue."},"group_id":"advisory:b9db791b-4a2b-4269-8a41-50ca0cc69f20","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/mar-2022-security-releases","advisory_id":"b9db791b-4a2b-4269-8a41-50ca0cc69f20","event_types":["patch"],"published_at":"2026-10-25T09:01:30.031691+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2022-03-18T01:52:00+00:00","detail_url":"/advisories/advisory%3Ab9db791b-4a2b-4269-8a41-50ca0cc69f20","group":{"id":"advisory:b9db791b-4a2b-4269-8a41-50ca0cc69f20","revision":1,"primary_event_id":33187,"change":"published","superseded_by":[],"changed":{"id":33187,"cve_ids":["CVE-2022-0778"],"payload":{"kind":"patch","title":"OpenSSL security releases require Node.js security releases","summary":"Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.","evidence":"Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v12.22.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"v12.22.11","evidence":"Node.js v12.22.11 (LTS)"},{"value":"v14.19.1","evidence":"Node.js v14.19.1 (LTS)"},{"value":"v16.14.2","evidence":"Node.js v16.14.2 (LTS)"},{"value":"v17.7.2","evidence":"Node.js v17.7.2 (Current)"}],"affected_versions":[{"value":"17.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"16.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"14.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"12.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."}]},{"name":{"value":"OpenSSL","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"},"prerequisites":[],"fixed_versions":[{"value":"3.0.2n","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"},{"value":"1.1.1n","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"}],"affected_versions":[]}],"severity":"high","related_cves":[{"value":"CVE-2022-0778","evidence":"(High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates."}],"security_relevant":true,"severity_evidence":"The 17.x release line of Node.js is vulnerable to one High severity issue."},"group_id":"advisory:b9db791b-4a2b-4269-8a41-50ca0cc69f20","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/mar-2022-security-releases","advisory_id":"b9db791b-4a2b-4269-8a41-50ca0cc69f20","event_types":["patch"],"published_at":"2026-10-25T09:01:30.031691+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2022-03-18T01:52:00+00:00","detail_url":"/events/33187"},"members":[{"id":33187,"cve_ids":["CVE-2022-0778"],"payload":{"kind":"patch","title":"OpenSSL security releases require Node.js security releases","summary":"Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.","evidence":"Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL.","products":[{"name":{"value":"Node.js","evidence":"Node.js v12.22.11 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"v12.22.11","evidence":"Node.js v12.22.11 (LTS)"},{"value":"v14.19.1","evidence":"Node.js v14.19.1 (LTS)"},{"value":"v16.14.2","evidence":"Node.js v16.14.2 (LTS)"},{"value":"v17.7.2","evidence":"Node.js v17.7.2 (Current)"}],"affected_versions":[{"value":"17.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"16.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"14.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."},{"value":"12.x","evidence":"Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines."}]},{"name":{"value":"OpenSSL","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"},"prerequisites":[],"fixed_versions":[{"value":"3.0.2n","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"},{"value":"1.1.1n","evidence":"Update to OpenSSL 3.0.2n and 1.1.1n"}],"affected_versions":[]}],"severity":"high","related_cves":[{"value":"CVE-2022-0778","evidence":"(High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates."}],"security_relevant":true,"severity_evidence":"The 17.x release line of Node.js is vulnerable to one High severity issue."},"group_id":"advisory:b9db791b-4a2b-4269-8a41-50ca0cc69f20","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/mar-2022-security-releases","advisory_id":"b9db791b-4a2b-4269-8a41-50ca0cc69f20","event_types":["patch"],"published_at":"2026-10-25T09:01:30.031691+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2022-03-18T01:52:00+00:00","detail_url":"/events/33187"}]}},{"id":29635,"cve_ids":["CVE-2016-2105","CVE-2016-2106","CVE-2016-2107","CVE-2016-2108","CVE-2016-2109","CVE-2016-2176"],"payload":{"kind":"patch","title":"OpenSSL updates, 1.0.1t and 1.0.2h","summary":"Node.js released updated versions across its active release lines incorporating OpenSSL security updates. The announcement identifies affected Node.js versions and says users should upgrade to the listed releases.","evidence":"The following releases have been made available to include the security updates to OpenSSL discussed in the post below. Please upgrade your Node.js installation as soon as possible in order to be protected against the disclosed vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1 and Node.js v4, v5 and v6 use OpenSSL v1.0.2"},"prerequisites":[],"fixed_versions":[{"value":"v6.1.0","evidence":"Node v6.1.0 (Current): /blog/release/v6.1.0/"},{"value":"v5.11.1","evidence":"Node v5.11.1: /blog/release/v5.11.1/"},{"value":"v4.4.4","evidence":"Node v4.4.4 (LTS): /blog/release/v4.4.4/"},{"value":"v0.12.14","evidence":"Node v0.12.14 (Maintenance): /blog/release/v0.12.14/"},{"value":"v0.10.45","evidence":"Node v0.10.45 (Maintenance): /blog/release/v0.10.45/"}],"affected_versions":[{"value":"v0.10","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1"},{"value":"v0.12","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1"},{"value":"v4","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"},{"value":"v5","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"},{"value":"v6","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"}]},{"name":{"value":"OpenSSL","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"},"prerequisites":[],"fixed_versions":[{"value":"1.0.1t","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"},{"value":"1.0.2h","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"}],"affected_versions":[]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2016-2107","evidence":"CVE-2016-2107: Padding oracle in AES-NI CBC MAC check"},{"value":"CVE-2016-2105","evidence":"CVE-2016-2105: EVP_EncodeUpdate overflow"},{"value":"CVE-2016-2108","evidence":"CVE-2016-2108: Memory corruption in the ASN.1 encoder"},{"value":"CVE-2016-2106","evidence":"CVE-2016-2106: EVP_EncryptUpdate overflow"},{"value":"CVE-2016-2109","evidence":"CVE-2016-2109: ASN.1 BIO excessive memory allocation (CVE-2016-2109)"},{"value":"CVE-2016-2176","evidence":"CVE-2016-2176: EBCDIC overread"}],"security_relevant":true,"severity_evidence":"The OpenSSL project has labelled this vulnerability high severity."},"group_id":"advisory:aa142c54-da72-489f-b5dc-e26493854fbe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-may-2016","advisory_id":"aa142c54-da72-489f-b5dc-e26493854fbe","event_types":["patch"],"published_at":"2026-10-25T20:39:25.690229+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-02T11:16:10+00:00","detail_url":"/advisories/advisory%3Aaa142c54-da72-489f-b5dc-e26493854fbe","group":{"id":"advisory:aa142c54-da72-489f-b5dc-e26493854fbe","revision":1,"primary_event_id":65630,"change":"published","superseded_by":[],"changed":{"id":65630,"cve_ids":["CVE-2016-2105","CVE-2016-2106","CVE-2016-2107","CVE-2016-2108","CVE-2016-2109","CVE-2016-2176"],"payload":{"kind":"patch","title":"OpenSSL updates, 1.0.1t and 1.0.2h","summary":"Node.js released updated versions across its active release lines incorporating OpenSSL security updates. The announcement identifies affected Node.js versions and says users should upgrade to the listed releases.","evidence":"The following releases have been made available to include the security updates to OpenSSL discussed in the post below. Please upgrade your Node.js installation as soon as possible in order to be protected against the disclosed vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1 and Node.js v4, v5 and v6 use OpenSSL v1.0.2"},"prerequisites":[],"fixed_versions":[{"value":"v6.1.0","evidence":"Node v6.1.0 (Current): /blog/release/v6.1.0/"},{"value":"v5.11.1","evidence":"Node v5.11.1: /blog/release/v5.11.1/"},{"value":"v4.4.4","evidence":"Node v4.4.4 (LTS): /blog/release/v4.4.4/"},{"value":"v0.12.14","evidence":"Node v0.12.14 (Maintenance): /blog/release/v0.12.14/"},{"value":"v0.10.45","evidence":"Node v0.10.45 (Maintenance): /blog/release/v0.10.45/"}],"affected_versions":[{"value":"v0.10","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1"},{"value":"v0.12","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1"},{"value":"v4","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"},{"value":"v5","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"},{"value":"v6","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"}]},{"name":{"value":"OpenSSL","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"},"prerequisites":[],"fixed_versions":[{"value":"1.0.1t","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"},{"value":"1.0.2h","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"}],"affected_versions":[]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2016-2107","evidence":"CVE-2016-2107: Padding oracle in AES-NI CBC MAC check"},{"value":"CVE-2016-2105","evidence":"CVE-2016-2105: EVP_EncodeUpdate overflow"},{"value":"CVE-2016-2108","evidence":"CVE-2016-2108: Memory corruption in the ASN.1 encoder"},{"value":"CVE-2016-2106","evidence":"CVE-2016-2106: EVP_EncryptUpdate overflow"},{"value":"CVE-2016-2109","evidence":"CVE-2016-2109: ASN.1 BIO excessive memory allocation (CVE-2016-2109)"},{"value":"CVE-2016-2176","evidence":"CVE-2016-2176: EBCDIC overread"}],"security_relevant":true,"severity_evidence":"The OpenSSL project has labelled this vulnerability high severity."},"group_id":"advisory:aa142c54-da72-489f-b5dc-e26493854fbe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-may-2016","advisory_id":"aa142c54-da72-489f-b5dc-e26493854fbe","event_types":["patch"],"published_at":"2026-10-25T20:39:25.690229+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-02T11:16:10+00:00","detail_url":"/events/65630"},"members":[{"id":65630,"cve_ids":["CVE-2016-2105","CVE-2016-2106","CVE-2016-2107","CVE-2016-2108","CVE-2016-2109","CVE-2016-2176"],"payload":{"kind":"patch","title":"OpenSSL updates, 1.0.1t and 1.0.2h","summary":"Node.js released updated versions across its active release lines incorporating OpenSSL security updates. The announcement identifies affected Node.js versions and says users should upgrade to the listed releases.","evidence":"The following releases have been made available to include the security updates to OpenSSL discussed in the post below. Please upgrade your Node.js installation as soon as possible in order to be protected against the disclosed vulnerabilities.","products":[{"name":{"value":"Node.js","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1 and Node.js v4, v5 and v6 use OpenSSL v1.0.2"},"prerequisites":[],"fixed_versions":[{"value":"v6.1.0","evidence":"Node v6.1.0 (Current): /blog/release/v6.1.0/"},{"value":"v5.11.1","evidence":"Node v5.11.1: /blog/release/v5.11.1/"},{"value":"v4.4.4","evidence":"Node v4.4.4 (LTS): /blog/release/v4.4.4/"},{"value":"v0.12.14","evidence":"Node v0.12.14 (Maintenance): /blog/release/v0.12.14/"},{"value":"v0.10.45","evidence":"Node v0.10.45 (Maintenance): /blog/release/v0.10.45/"}],"affected_versions":[{"value":"v0.10","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1"},{"value":"v0.12","evidence":"Node.js v0.10 and v0.12 both use OpenSSL v1.0.1"},{"value":"v4","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"},{"value":"v5","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"},{"value":"v6","evidence":"Node.js v4, v5 and v6 use OpenSSL v1.0.2"}]},{"name":{"value":"OpenSSL","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"},"prerequisites":[],"fixed_versions":[{"value":"1.0.1t","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"},{"value":"1.0.2h","evidence":"The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week"}],"affected_versions":[]}],"severity":"high","fixed_cves":[],"related_cves":[{"value":"CVE-2016-2107","evidence":"CVE-2016-2107: Padding oracle in AES-NI CBC MAC check"},{"value":"CVE-2016-2105","evidence":"CVE-2016-2105: EVP_EncodeUpdate overflow"},{"value":"CVE-2016-2108","evidence":"CVE-2016-2108: Memory corruption in the ASN.1 encoder"},{"value":"CVE-2016-2106","evidence":"CVE-2016-2106: EVP_EncryptUpdate overflow"},{"value":"CVE-2016-2109","evidence":"CVE-2016-2109: ASN.1 BIO excessive memory allocation (CVE-2016-2109)"},{"value":"CVE-2016-2176","evidence":"CVE-2016-2176: EBCDIC overread"}],"security_relevant":true,"severity_evidence":"The OpenSSL project has labelled this vulnerability high severity."},"group_id":"advisory:aa142c54-da72-489f-b5dc-e26493854fbe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/openssl-may-2016","advisory_id":"aa142c54-da72-489f-b5dc-e26493854fbe","event_types":["patch"],"published_at":"2026-10-25T20:39:25.690229+00:00","technologies":["node-js","nodejs","openssl"],"context_update":false,"extraction_method":"llm","source_published_at":"2016-05-02T11:16:10+00:00","detail_url":"/events/65630"}]}}],"next_after":70141,"next_before":29635}