{"id":"CVE-2020-11080","aliases":["ALPINE-CVE-2020-11080","ALSA-2020:2755","ALSA-2020:2848","ALSA-2020:2852","BELL-CVE-2020-11080","BIT-node-2020-11080","BIT-node-min-2020-11080","CLSA-2026-1788175030","DEBIAN-CVE-2020-11080","DLA-2786-1","DLA-3621-1","DSA-4696-1","EUVD-2020-3444","GHSA-q5wr-xfw9-q7xr","JLSEC-2026-1","MGASA-2020-0256","RHSA-2020:2523","RHSA-2020:2524","RHSA-2020:2644","RHSA-2020:2755","RHSA-2020:2784","RHSA-2020:2823","RHSA-2020:2847","RHSA-2020:2848","RHSA-2020:2849","RHSA-2020:2850","RHSA-2020:2852","RHSA-2020:2895","RHSA-2020:3042","RHSA-2020:3084","RLSA-2020:2755","RLSA-2020:2848","RLSA-2020:2852","SUSE-SU-2020:1568-1","SUSE-SU-2020:1575-1","SUSE-SU-2020:1576-1","SUSE-SU-2020:1606-1","SUSE-SU-2020:2800-1","SUSE-SU-2021:0930-1","SUSE-SU-2021:0931-1","SUSE-SU-2021:0932-1","UBUNTU-CVE-2020-11080","USN-6142-1","openSUSE-SU-2020:0802-1","openSUSE-SU-2021:0468-1","openSUSE-SU-2024:11091-1","openSUSE-SU-2024:11096-1"],"status":"published","title":"Denial of service in nghttp2","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.05316,"percentile":0.92703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-707"],"published":"2020-06-03T00:00:00Z","modified":"2026-11-03T06:32:36Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"nghttp2","fixed_in":["1.39.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nghttp2","fixed_in":["1.40.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nghttp2","fixed_in":["1.41.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"nghttp2","fixed_in":["1.35.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["12.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["12.18.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libnghttp2","fixed_in":["1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libnghttp2-devel","fixed_in":["1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nghttp2","fixed_in":["1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["10.21.0","12.18.0","14.4.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["10.12.1","10.21.0","12.12.1","12.18.0","14.4.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nghttp2","fixed_in":["1.41.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nghttp2","fixed_in":["1.41.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nghttp2","fixed_in":["1.41.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["10.21.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["10.21.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["10.21.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"nghttp2_jll","fixed_in":["1.41.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"nghttp2","fixed_in":["1.41.0-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-proxy","fixed_in":["0:1.1.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-proxy","fixed_in":["0:1.0.10-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libnghttp2","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libnghttp2-debuginfo","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2-debuginfo","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2-debugsource","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libnghttp2-debuginfo","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libnghttp2-devel","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2-debuginfo","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2-debugsource","fixed_in":["0:1.33.0-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libnghttp2","fixed_in":["0:1.7.1-8.el6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libnghttp2-devel","fixed_in":["0:1.7.1-8.el6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-nghttp2","fixed_in":["0:1.7.1-8.el6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-nghttp2-debuginfo","fixed_in":["0:1.7.1-8.el6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libnghttp2","fixed_in":["0:1.7.1-8.el7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libnghttp2-devel","fixed_in":["0:1.7.1-8.el7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-nghttp2","fixed_in":["0:1.7.1-8.el7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-nghttp2-debuginfo","fixed_in":["0:1.7.1-8.el7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"libnghttp2","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"libnghttp2-debuginfo","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"nghttp2","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"nghttp2-debuginfo","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"nghttp2-debugsource","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"libnghttp2-debuginfo","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"libnghttp2-devel","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"nghttp2","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"nghttp2-debuginfo","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"nghttp2-debugsource","fixed_in":["0:1.33.0-3.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libnghttp2","fixed_in":["0:1.33.0-1.el8_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libnghttp2-debuginfo","fixed_in":["0:1.33.0-1.el8_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"nghttp2","fixed_in":["0:1.33.0-1.el8_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"nghttp2-debuginfo","fixed_in":["0:1.33.0-1.el8_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"nghttp2-debugsource","fixed_in":["0:1.33.0-1.el8_0.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"nghttp2","fixed_in":["0:1.33.0-3.el8_3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"nghttp2","fixed_in":["1.40.0-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"nghttp2","fixed_in":["1.40.0-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"nghttp2","fixed_in":["1.40.0-3.11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nghttp2","fixed_in":["1.7.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nghttp2","fixed_in":["1.30.0-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nghttp2","fixed_in":["1.40.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"nghttp2","fixed_in":["1.40.0-lp152.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"nghttp2-python","fixed_in":["1.40.0-lp152.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"10.13.0"},{"fixed":"10.21.0"},{"introduced":"12.13.0"},{"fixed":"12.18.0"},{"introduced":"14.0.0"},{"fixed":"14.4.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.12.1"},{"introduced":"10.13.0"},{"fixed":"10.21.0"},{"introduced":"12.0.0"},{"fixed":"12.12.1"},{"introduced":"12.13.0"},{"fixed":"12.18.0"},{"introduced":"14.0.0"},{"fixed":"14.4.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnghttp2-14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnghttp2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnghttp2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nghttp2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nghttp2-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nghttp2-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1+deb9u2"}]}],"versions":["1.18.1-1","1.18.1-1+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2+deb10u2"}]}],"versions":["1.36.0-2","1.36.0-2+deb10u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0~dfsg-1~deb10u1"}]}],"versions":["10.15.2~dfsg-2","10.15.3~dfsg-1","10.16.3~dfsg-1","10.17.0~dfsg-1","10.17.0~dfsg-2","10.19.0~dfsg-1","10.19.0~dfsg-2","10.19.0~dfsg-3","10.19.0~dfsg1-1","10.20.0~dfsg-1","10.20.1~dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"nghttp2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.41.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.10-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.64.1-36.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.64.1-36.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.64.1-36.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.64.1-36.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.14-4.Final_redhat_2.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.14-4.Final_redhat_2.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-4.redhat_1.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-4.redhat_1.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-4.redhat_1.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-4.redhat_1.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-24.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-24.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-51.GA.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-51.GA.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-57.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-25.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-25.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-25.jbcs.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.64.1-36.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.64.1-36.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.64.1-36.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.64.1-36.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.14-4.Final_redhat_2.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.14-4.Final_redhat_2.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-4.redhat_1.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-4.redhat_1.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-4.redhat_1.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.48-4.redhat_1.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-24.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-24.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-51.GA.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-51.GA.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-57.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-25.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-25.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-nghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.39.2-25.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-pkcs11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-7.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-pkcs11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-7.jbcs.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.5-1.12.18.2.1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.2.0+7071+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.2.0+7071+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.2.0+7071+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.2.0+7071+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.2.0+7071+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.2.0+7071+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.4-1.10.21.0.3.module+el8.2.0+7071+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.1.0+7070+fe09e702"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.1.0+7070+fe09e702"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.1.0+7070+fe09e702"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.1.0+7070+fe09e702"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.1.0+7070+fe09e702"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.1.0+7070+fe09e702"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.4-1.10.21.0.3.module+el8.1.0+7070+fe09e702"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.el8_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.el8_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.el8_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.el8_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.el8_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.5-1.12.18.2.1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.5-12.18.2.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.0.0+7067+054302d1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.0.0+7067+054302d1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.0.0+7067+054302d1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.0.0+7067+054302d1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.0.0+7067+054302d1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.21.0-3.module+el8.0.0+7067+054302d1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.4-1.10.21.0.3.module+el8.0.0+7067+054302d1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.21.0-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.21.0-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.21.0-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.21.0-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.4-10.21.0.3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-3.el8_3.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-1.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-1.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-1.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-1.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-1.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-1.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-1.24.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.32.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.32.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.32.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.32.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.32.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1ubuntu0.1~esm1"}]}],"versions":["0.6.7-1","1.3.4-2","1.4.0-1","1.4.0-2","1.5.0-2","1.6.0-1","1.7.0-1","1.7.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+esm1"}]}],"versions":["1.25.0-1","1.27.0-1","1.28.0-1","1.29.0-1","1.29.0-1build1","1.30.0-1","1.30.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-1ubuntu0.1"}]}],"versions":["1.39.2-1","1.40.0-1","1.40.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1ubuntu0.1~esm1"}]}],"versions":["0.6.7-1","1.3.4-2","1.4.0-1","1.4.0-2","1.5.0-2","1.6.0-1","1.7.0-1","1.7.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+esm1"}]}],"versions":["1.25.0-1","1.27.0-1","1.28.0-1","1.29.0-1","1.29.0-1build1","1.30.0-1","1.30.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-1ubuntu0.1"}]}],"versions":["1.39.2-1","1.40.0-1","1.40.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-lp151.2.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-lp152.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nghttp2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-lp152.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-1.6"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-1.2"}]}],"bundled":19}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nghttp2","product":"nghttp2"},{"vendor":"nodejs","product":"node.js"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"banking_extensibility_workbench"},{"vendor":"oracle","product":"blockchain_platform"},{"vendor":"oracle","product":"enterprise_communications_broker"},{"vendor":"oracle","product":"graalvm"},{"vendor":"oracle","product":"mysql"}],"references":[{"url":"https://www.debian.org/security/2020/dsa-4696","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web","article","report"]},{"url":"https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-11080","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-2755.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-11080","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-2848.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-7598","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8174","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-2852.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-8172","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-11080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11080","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788175030.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-11080","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0256.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26725","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2523","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844929","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2523.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11080","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2524","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2524.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2644","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695030","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1799734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1799786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1820772","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBCS-941","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2644.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20843","tags":["advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0196","tags":["advisory"]},{"url":"http://www.apache.org/dist/httpd/CHANGES_2.4","tags":["article"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0197","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19956","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20388","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1934","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7595","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2755","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2755.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2784","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2784.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2823","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2823.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2847","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845256","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2847.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7598","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7598","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8172","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8172","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8172","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8174","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8174","tags":["advisory"]},{"url":"https://hackerone.com/reports/784186","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2848","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2848.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2849","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2849.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2850","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2850.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2852","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2852.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2895","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1807349","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2895.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10531","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10531","tags":["advisory"]},{"url":"https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3042","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3042.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3084","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3084.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:2755","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:2848","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:2852","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201568-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1162117","tags":["report"]},{"url":"https://bugzilla.suse.com/1166844","tags":["report"]},{"url":"https://bugzilla.suse.com/1166916","tags":["report"]},{"url":"https://bugzilla.suse.com/1172442","tags":["report"]},{"url":"https://bugzilla.suse.com/1172443","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8174","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201575-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201576-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201606-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172441","tags":["report"]},{"url":"https://bugzilla.suse.com/1172728","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8172","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202800-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172686","tags":["report"]},{"url":"https://bugzilla.suse.com/1173937","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15095","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210930-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181358","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210931-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210932-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1088639","tags":["report"]},{"url":"https://bugzilla.suse.com/1112438","tags":["report"]},{"url":"https://bugzilla.suse.com/1125689","tags":["report"]},{"url":"https://bugzilla.suse.com/1134616","tags":["report"]},{"url":"https://bugzilla.suse.com/1146182","tags":["report"]},{"url":"https://bugzilla.suse.com/1146184","tags":["report"]},{"url":"https://bugzilla.suse.com/962914","tags":["report"]},{"url":"https://bugzilla.suse.com/964140","tags":["report"]},{"url":"https://bugzilla.suse.com/966514","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9513","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-11080","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/#http-2-large-settings-frame-dos-low-cve-2020-11080","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6142-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RQM2VNI6BXE7OOJSD4OI2KDH2ZTRUUCD/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3FQEUDKQEBT4RUZ2JLDQBWSAYUJ4SCTW/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-11080","title":"Denial of service in nghttp2","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2020-06-03T00:00:00Z","modified":"2025-06-09T15:45:50.711Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-707"],"updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-3444","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2020-06-03T00:00:00Z","modified":"2025-06-09T15:45:50Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"nvd":[{"id":"CVE-2020-11080","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2020-06-03T23:15:11.073Z","modified":"2026-06-17T02:49:00.52Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-707","CWE-400"],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"ALPINE-CVE-2020-11080","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2020-06-03T23:15:11.073Z","modified":"2026-11-03T06:32:36.038232847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"BELL-CVE-2020-11080","title":"CVE-2020-11080 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:09.178491Z","modified":"2026-02-18T07:38:23.388747Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-11080","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2020-06-03T23:15:11.073Z","modified":"2026-10-24T14:12:07.023039863Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-11080","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2020-06-03T23:15:11.073Z","modified":"2026-10-26T12:01:19.785337849Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"JLSEC-2026-1","title":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of...","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement `nghttp2_on_frame_recv_callback` callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2026-03-23T22:38:33.248Z","modified":"2026-07-25T18:23:46.602301185Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"RHSA-2020:2523","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.2 servicemesh-proxy security update","status":"published","published":"2024-09-13T22:04:33Z","modified":"2026-09-21T10:02:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2524","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-proxy security update","status":"published","published":"2024-09-13T22:04:25Z","modified":"2026-09-21T10:02:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2644","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update","status":"published","published":"2024-09-13T22:41:50Z","modified":"2026-09-21T10:02:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2755","title":"Red Hat Security Advisory: nghttp2 security update","status":"published","published":"2024-09-13T22:04:52Z","modified":"2026-09-21T10:02:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2784","title":"Red Hat Security Advisory: httpd24-nghttp2 security update","status":"published","published":"2024-09-13T22:05:16Z","modified":"2026-09-21T10:02:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2823","title":"Red Hat Security Advisory: nghttp2 security update","status":"published","published":"2024-09-13T22:04:53Z","modified":"2026-09-21T10:02:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2847","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T22:42:08Z","modified":"2026-10-09T10:01:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2848","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:42:01Z","modified":"2026-10-09T10:01:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2849","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:41:16Z","modified":"2026-10-09T10:01:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2850","title":"Red Hat Security Advisory: nghttp2 security update","status":"published","published":"2024-09-13T22:05:11Z","modified":"2026-09-21T10:02:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2852","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T22:41:24Z","modified":"2026-10-09T10:01:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2895","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:41:31Z","modified":"2026-10-15T10:01:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3042","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:41:55Z","modified":"2026-10-09T10:01:50Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3084","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T22:41:46Z","modified":"2026-10-15T10:01:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RLSA-2020:2755","title":"Important: nghttp2 security update","description":"libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-06-25T16:31:29Z","modified":"2026-02-05T04:15:13.33814Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2020:2848","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.21.0).\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-07-07T08:51:24Z","modified":"2026-02-05T09:00:12.101808Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2020:2852","title":"Important: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.2).\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)\n\n* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-07-07T08:52:35Z","modified":"2026-02-04T07:40:24.01288Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-11080","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2020-06-03T23:15:00Z","modified":"2026-04-22T12:26:18.472917Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"ALSA-2020:2755","title":"Important: nghttp2 security update","description":"libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-06-25T16:31:29Z","modified":"2026-10-29T11:00:14.493733764Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2020:2848","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.21.0).\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-07-07T08:51:24Z","modified":"2026-10-29T11:00:18.034401255Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2020:2852","title":"Important: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.2).\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)\n\n* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-07-07T08:52:35Z","modified":"2026-10-29T11:00:17.177842956Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-node-2020-11080","title":"Denial of service in nghttp2","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2024-03-06T11:08:52.092Z","modified":"2026-09-08T08:48:17.416597953Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2020-11080","title":"Denial of service in nghttp2","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.","status":"published","published":"2024-12-16T14:07:31.129Z","modified":"2026-09-08T08:48:16.826578335Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2026-1788175030","title":"Fix CVE(s): CVE-2020-11080, CVE-2023-35945, CVE-2023-44487","description":"   * SECURITY UPDATE: denial of service via HTTP/2 stream reset flood\n     (Rapid Reset)\n     - debian/patches/CVE-2023-44487.patch: rate-limit incoming RST_STREAM\n       on server sessions with a token bucket (burst 1000, 33 tokens per\n       second) and send GOAWAY once it is exhausted, adding the\n       nghttp2_ratelim and nghttp2_time modules and the clock_gettime /\n       GetTickCount64 probes they need.  Backported without upstream's new\n       public option setter, so debian/libnghttp2-14.symbols is unchanged.\n     - CVE-2023-44487","status":"published","published":"2026-08-31T11:17:24Z","modified":"2026-10-26T09:32:04.177639018Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-2786-1","title":"nghttp2 - security update","status":"published","published":"2021-10-16T00:00:00Z","modified":"2026-03-09T01:22:11.666258Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3621-1","title":"nghttp2 - security update","status":"published","published":"2023-10-16T00:00:00Z","modified":"2026-03-09T01:23:05.508085Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-4696-1","title":"nodejs - security update","status":"published","published":"2020-06-06T00:00:00Z","modified":"2026-03-09T02:08:38.270461Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0256","title":"Updated nghttp2 packages fix security vulnerability","description":"nghttp2 has been updated to version 1.41.0 to fix CVE-2020-11080.\n\nThe overly large HTTP/2 SETTINGS frame payload causes denial of service.\n\nThe proof of concept attack involves a malicious client constructing a\nSETTINGS frame with a length of 14,400 bytes (2400 individual settings\nentries) over and over again. The attack causes the CPU to spike at 100%.\n","status":"published","published":"2020-06-10T23:59:36Z","modified":"2026-04-16T04:40:41.460013453Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0802-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).\n- CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). \n- CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying \n  properties of Object.prototype (bsc#1166916).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-12T18:17:49Z","modified":"2026-02-04T04:32:35.909708Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2021:0468-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issues:\n\n- CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-03-25T08:10:28Z","modified":"2026-02-04T02:50:36.769696Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11091-1","title":"libnghttp2-14-1.43.0-1.6 on GA media","description":"These are all security issues fixed in the libnghttp2-14-1.43.0-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:51.911369Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11096-1","title":"nodejs14-14.17.5-1.2 on GA media","description":"These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:56.833198Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:1568-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nnodejs10 was updated to version 10.21.0 \t  \n\n- CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).\n- CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). \n- CVE-2020-10531: Fixed an integer overflow in UnicodeString:doAppend() (bsc#1166844).\n- Fixed an issue with openssl by adding getrandom syscall definition for all Linux platforms (bsc#1162117).\n\nnpm was updated to 6.14.3 \n\n- CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying \n  properties of Object.prototype (bsc#1166916).\n","status":"published","published":"2020-06-09T09:12:48Z","modified":"2025-05-02T04:09:33.241756Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1575-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nnodejs10 was updated to version 10.21.0 \t  \n\n- CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).\n- CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). \n- CVE-2020-10531: Fixed an integer overflow in UnicodeString:doAppend() (bsc#1166844).\n\nnpm was updated to 6.14.3 \n\n- CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying \n  properties of Object.prototype (bsc#1166916).\n","status":"published","published":"2020-06-09T12:16:12Z","modified":"2026-02-04T02:21:56.80161Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1576-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).\n- CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). \n- CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying \n  properties of Object.prototype (bsc#1166916).\n","status":"published","published":"2020-06-09T12:17:03Z","modified":"2026-02-04T04:28:57.505132Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1606-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nnodejs12 was updated to version 12.18.0 \t  \n\n- CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).\n- CVE-2020-8172: Fixed am issue where TLS session reuse could have led to host certificate verification bypass (bsc#1172441).\n- CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). \n\nnpm was updated to 6.13.6\n\n- CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying \n  properties of Object.prototype (bsc#1166916).\n","status":"published","published":"2020-06-11T10:10:55Z","modified":"2026-02-04T03:36:31.661302Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2800-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).\n- CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). \n- CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying \n  properties of Object.prototype (bsc#1166916)\n- CVE-2020-15095: Fixed information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686).\n- Add Require for nodejs8 when intalling npm8 (bsc#1172728)\n","status":"published","published":"2020-09-30T07:56:15Z","modified":"2026-02-04T02:37:28.073848Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2021:0930-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issues:\n\n- CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358)\n","status":"published","published":"2021-03-24T11:09:32Z","modified":"2026-02-04T02:26:38.820798Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0931-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issues:\n\n- CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358)\n","status":"published","published":"2021-03-24T11:11:11Z","modified":"2026-02-04T02:47:14.501155Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0932-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358).\n- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184).\n- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146182).\n- CVE-2018-1000168: Fixed ALTSVC frame client side denial of service (bsc#1088639).\n- CVE-2016-1544: Fixed out of memory due to unlimited incoming HTTP header fields (bsc#966514).\n\nBug fixes and enhancements:\n\n- Packages must not mark license files as %doc (bsc#1082318)\n- Typo in description of libnghttp2_asio1 (bsc#962914)\n- Fixed mistake in spec file (bsc#1125689)\n- Fixed build issue with boost 1.70.0 (bsc#1134616)\n- Fixed build issue with GCC 6 (bsc#964140)\n- Feature: Add W\u0026S module (FATE#326776, bsc#1112438)\n  ","status":"published","published":"2021-03-24T11:13:09Z","modified":"2026-02-04T03:24:08.572165Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-6142-1","title":"nghttp2 vulnerability","description":"Gal Goldshtein discovered that nghttp2 incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a\ndenial of service.\n","status":"published","published":"2023-06-06T08:20:51Z","modified":"2026-06-25T13:32:08.403079109Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}