Unrated
December Security Release Schedule Update
Node.js postponed its planned security releases to include upstream OpenSSL fixes and announced vulnerabilities affecting several Node.js release lines. Fixes were planned for v4.x and v5.x for CVE-2015-6764, alongside CVE-2015-8027; the announcement gives no released fixed versions.
Announced Source revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
we have decided to postpone our security releases to coincide with OpenSSL release availability
Node.js
Node.js versions v0.10.x and v0.12.x depend on OpenSSL v1.0.1
- Affected versions
- all versions of v0.12.x through to v5.x inclusive
A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive
all versions of v4.x and v5.xAn additional bug exists in Node.js, all versions of v4.x and v5.x
Versions 0.10.xVersions 0.10.x of Node.js may be vulnerable.
Versions 0.12.xVersions 0.12.x of Node.js may be vulnerable.
Versions 4.x, including LTS ArgonVersions 4.x, including LTS Argon, of Node.js may be vulnerable.
Versions 5.xVersions 5.x of Node.js may be vulnerable.
- Fixed versions
- Not stated in this extraction
- Prerequisites
- if user-supplied JavaScript can be executed by an application
if user-supplied JavaScript can be executed by an application
- Related CVEs
- CVE-2015-8027
CVE-2015-8027 Denial of Service Vulnerability
CVE-2015-6764CVE-2015-6764 V8 Out-of-bounds Access Vulnerability
Publisher severity
No explicit severity was extracted.
- Event
- #70705 · Revision 1
- Added to Heist Feed
- Publisher date