{"id":"CVE-2020-8265","aliases":["ALPINE-CVE-2020-8265","ALSA-2021:0548","ALSA-2021:0549","ALSA-2021:0551","BELL-CVE-2020-8265","BIT-node-2020-8265","BIT-node-min-2020-8265","DEBIAN-CVE-2020-8265","DSA-4826-1","EUVD-2020-29134","GHSA-879w-9vpf-9pw9","MGASA-2021-0069","OESA-2021-1058","RHSA-2021:0421","RHSA-2021:0485","RHSA-2021:0521","RHSA-2021:0548","RHSA-2021:0549","RHSA-2021:0551","RLSA-2021:0548","RLSA-2021:0549","RLSA-2021:0551","SUSE-SU-2021:0060-1","SUSE-SU-2021:0061-1","SUSE-SU-2021:0062-1","SUSE-SU-2021:0068-1","SUSE-SU-2021:0082-1","SUSE-SU-2021:0107-1","UBUNTU-CVE-2020-8265","USN-6380-1","openSUSE-SU-2021:0064-1","openSUSE-SU-2021:0065-1","openSUSE-SU-2021:0066-1","openSUSE-SU-2021:0082-1","openSUSE-SU-2024:11096-1"],"status":"published","title":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug...","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.09116,"percentile":0.95374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2021-01-06T00:00:00Z","modified":"2026-11-03T06:32:31Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["12.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["12.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["14.15.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["15.5.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["10.23.1","12.20.1","14.15.4","15.5.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["10.23.1","12.20.1","14.15.4","15.5.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["12.20.1~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["12.20.1~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["12.20.1~dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","fixed_in":["4.2.6~dfsg-1ubuntu4.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","fixed_in":["8.10.0~dfsg-2ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nodejs","fixed_in":["10.19.0~dfsg-3ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":7},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.23.1"},{"introduced":"12.0.0"},{"fixed":"12.20.1"},{"introduced":"14.0.0"},{"fixed":"14.15.4"},{"introduced":"15.0.0"},{"fixed":"15.5.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.23.1"},{"introduced":"12.0.0"},{"fixed":"12.20.1"},{"introduced":"14.0.0"},{"fixed":"14.15.4"},{"introduced":"15.0.0"},{"fixed":"15.5.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1~dfsg-1~deb10u1"}]}],"versions":["10.15.2~dfsg-2","10.15.3~dfsg-1","10.16.3~dfsg-1","10.17.0~dfsg-1","10.17.0~dfsg-2","10.19.0~dfsg-1","10.19.0~dfsg-2","10.19.0~dfsg-3","10.19.0~dfsg1-1","10.20.0~dfsg-1","10.20.1~dfsg-1","10.21.0~dfsg-1","10.21.0~dfsg-1~deb10u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-10.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.21.0-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-14.15.4.2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-12.20.1.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-10.23.1.2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+9715+1718613f"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.14.15.4.2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-1.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-1.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-1.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-1.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-1.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-1.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-5.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-4.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-1.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-1.33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-6.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6~dfsg-1ubuntu4.2+esm2"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm2"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg-3ubuntu1.1"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6~dfsg-1ubuntu4.2+esm2"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm2"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg-3ubuntu1.1"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-lp152.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-lp152.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.15.4-lp152.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.23.1-lp151.2.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-1.2"}]}],"bundled":19}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"},{"vendor":"oracle","product":"graalvm"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://hackerone.com/reports/988103","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","advisory","fix","article","report"]},{"url":"https://www.debian.org/security/2021/dsa-4826","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202101-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210212-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8265","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/"},{"url":"https://github.com/advisories/GHSA-879w-9vpf-9pw9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8265","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0548.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15095","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-15366","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7608","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7754","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7774","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7788","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8116","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8252","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8265","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8287","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0549.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2018-3750","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-10746","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-10747","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0551.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-8277","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8265","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8265","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0069.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28015","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v10.23.1/","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8287","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0421","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912863","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0421.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7754","tags":["advisory"]},{"url":"https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7774","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-Y18N-1021887","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8265","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8277","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-AJV-584908","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0485","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795479","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0485.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578246","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3750","tags":["advisory"]},{"url":"https://hackerone.com/reports/311333","tags":["article"]},{"url":"https://nodesecurity.io/advisories/612","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10746","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10747","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0521","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1840004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879315","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0521.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8116","tags":["advisory"]},{"url":"https://hackerone.com/reports/719856","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0548","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0549","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0549.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0551","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0551.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0548","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0549","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0551","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210060-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179491","tags":["report"]},{"url":"https://bugzilla.suse.com/1180553","tags":["report"]},{"url":"https://bugzilla.suse.com/1180554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8287","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210061-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178882","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8277","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210062-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210068-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210082-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210107-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8265","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a30ed","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6380-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-15604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8287","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EIIX5B6YLG6I6J4WR546EWZU23BNUSV6/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3MAV3V72VVUTVO6VC6SN5XB5EYX3TJWK/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WYFKSVZAWD7RDU5OST2FANHMDWL4VNM7/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JQ2RC7AEXMLHMCFO7K3XLJO5WMPQXS7V/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-8265","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2021-01-06T21:01:15Z","modified":"2025-04-30T22:24:28.624Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29134","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2021-01-06T21:01:15Z","modified":"2025-04-30T22:24:28Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-879w-9vpf-9pw9","title":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug...","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2022-05-24T17:38:07Z","modified":"2023-01-29T05:05:16Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:45:45.423268Z"}],"nvd":[{"id":"CVE-2020-8265","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2021-01-06T21:15:14.41Z","modified":"2026-06-17T03:26:09.627Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:28.892872Z"}],"osv":[{"id":"ALPINE-CVE-2020-8265","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2021-01-06T21:15:14.41Z","modified":"2026-11-03T06:32:31.577654443Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"BELL-CVE-2020-8265","title":"CVE-2020-8265 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:21.617343Z","modified":"2026-02-18T07:38:24.234437Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8265","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2021-01-06T21:15:14.41Z","modified":"2026-10-24T10:30:31.858904325Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8265","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2021-01-06T21:15:14.41Z","modified":"2026-10-26T12:02:51.736290508Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"OESA-2021-1058","title":"nodejs security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\r\n\r\nNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.(CVE-2020-8287)\r\n\r\nNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.(CVE-2020-8265)","status":"published","published":"2021-03-05T11:04:17Z","modified":"2026-08-18T01:15:15.409718382Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:0421","title":"Red Hat Security Advisory: rh-nodejs14-nodejs security update","status":"published","published":"2024-09-13T22:43:44Z","modified":"2026-10-13T10:02:07Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0485","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:44:36Z","modified":"2026-06-28T10:42:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0521","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T22:43:33Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0548","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:43:41Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0549","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T22:43:49Z","modified":"2026-06-28T10:42:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0551","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-09-13T22:43:56Z","modified":"2026-10-13T10:02:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-02-04T20:15:14.123658Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0549","title":"Moderate: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).\n\nSecurity Fix(es):\n\n* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)\n\n* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:29Z","modified":"2026-02-05T12:15:07.1896Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0551","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.15.4).\n\nSecurity Fix(es):\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)","status":"published","published":"2021-02-16T07:34:42Z","modified":"2026-02-04T22:30:04.79773Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-8265","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2021-01-06T21:15:00Z","modified":"2026-04-22T12:43:35.365032Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-10-29T11:00:27.308699758Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0549","title":"Moderate: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).\n\nSecurity Fix(es):\n\n* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)\n\n* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:29Z","modified":"2026-10-29T11:12:03.862338147Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0551","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.15.4).\n\nSecurity Fix(es):\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)","status":"published","published":"2021-02-16T07:34:42Z","modified":"2026-10-29T11:00:40.22016781Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-node-2020-8265","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2024-03-06T11:07:41.583Z","modified":"2026-10-16T09:45:31.649934477Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2020-8265","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.","status":"published","published":"2024-12-16T14:06:36.218Z","modified":"2026-10-16T09:45:30.463978602Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"DSA-4826-1","title":"nodejs - security update","status":"published","published":"2021-01-06T00:00:00Z","modified":"2026-03-09T02:08:31.461514Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0069","title":"Updated nodejs packages fix security vulnerabilities","description":"Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a\nuse-after-free bug in its TLS implementation. When writing to a TLS enabled\nsocket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly\nallocated WriteWrap object as first argument. If the DoWrite method does not\nreturn an error, this object is passed back to the caller as part of a\nStreamWriteResult structure. This may be exploited to corrupt memory leading\nto a Denial of Service or potentially other exploits. (CVE-2020-8265).\n\nNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of\na header field in an HTTP request (for example, two Transfer-Encoding header\nfields). In this case, Node.js identifies the first header field and ignores\nthe second. This can lead to HTTP Request Smuggling. (CVE-2020-8287).\n","status":"published","published":"2021-02-05T11:54:53Z","modified":"2026-04-16T04:41:46.01540754Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0064-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- New upstream LTS version 12.20.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 12.20.0:\n  * deps:\n    + update llhttp '2.1.2' -\u003e '2.1.3'\n    + update uv '1.39.0' -\u003e '1.40.0'\n    + update uvwasi '0.0.10' -\u003e '0.0.11'\n  * fs: add .ref() and .unref() methods to watcher classes\n  * http: added scheduling option to http agent\n  * module:\n    + exports pattern support\n    + named exports for CJS via static analysis\n  * n-api: add more property defaults (gh#35214)\n\n- New upstream LTS version 12.19.1:\n  * deps: Denial of Service through DNS request (High).\n  A Node.js application that allows an attacker to trigger a DNS\n  request for a host of their choice could trigger a Denial of Service\n  by getting the application to resolve a DNS record with\n  a larger number of responses (bsc#1178882, CVE-2020-8277)\n\n- New upstream LTS version 12.19.0:\n  * crypto: add randomInt function\n  * deps:\n    + upgrade to libuv 1.39.0\n    + deps: upgrade npm to 6.14.7\n    + deps: upgrade to libuv 1.38.1\n  * doc: deprecate process.umask() with no arguments\n  * module:\n    + package 'imports' field\n    + module: deprecate module.parent\n  * n-api: create N-API version 7\n  * zlib: switch to lazy init for zlib streams\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-01-15T09:23:17Z","modified":"2026-02-04T02:19:32.46766Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0065-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- New upstream LTS version 10.23.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 10.23.0:\n  * deps: upgrade npm to 6.14.8\n  * n-api:\n    + create N-API version 7\n    + expose napi_build_version variable\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-15T09:23:23Z","modified":"2026-02-04T04:35:17.861511Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0066-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- New upstream LTS version 14.15.4:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n\n- New upstream LTS version 14.15.3:\n  * deps:\n    + upgrade npm to 6.14.9\n    + update acorn to v8.0.4\n  * http2: check write not scheduled in scope destructor\n  * stream: fix regression on duplex end\n\n- New upstream LTS version 14.15.1:\n  * deps: Denial of Service through DNS request (High).\n  A Node.js application that allows an attacker to trigger a DNS\n  request for a host of their choice could trigger a Denial of Service\n  by getting the application to resolve a DNS record with\n  a larger number of responses (bsc#1178882, CVE-2020-8277)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-01-15T09:23:32Z","modified":"2026-02-04T03:18:17.747434Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0082-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- New upstream LTS version 10.23.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 10.23.0:\n  * deps: upgrade npm to 6.14.8\n  * n-api:\n    + create N-API version 7\n    + expose napi_build_version variable\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-16T11:24:40Z","modified":"2026-02-04T03:58:18.319653Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11096-1","title":"nodejs14-14.17.5-1.2 on GA media","description":"These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:56.833198Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:0060-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- New upstream LTS version 10.23.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 10.23.0:\n  * deps: upgrade npm to 6.14.8\n  * n-api:\n    + create N-API version 7\n    + expose napi_build_version variable\n","status":"published","published":"2021-01-11T14:01:13Z","modified":"2026-02-04T02:49:09.182539Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0061-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- New upstream LTS version 14.15.4:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n\n- New upstream LTS version 14.15.3:\n  * deps:\n    + upgrade npm to 6.14.9\n    + update acorn to v8.0.4\n  * http2: check write not scheduled in scope destructor\n  * stream: fix regression on duplex end\n\n- New upstream LTS version 14.15.1:\n  * deps: Denial of Service through DNS request (High).\n  A Node.js application that allows an attacker to trigger a DNS\n  request for a host of their choice could trigger a Denial of Service\n  by getting the application to resolve a DNS record with\n  a larger number of responses (bsc#1178882, CVE-2020-8277)\n","status":"published","published":"2021-01-11T14:01:32Z","modified":"2026-02-04T03:26:50.147968Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0062-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- New upstream LTS version 12.20.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 12.20.0:\n  * deps:\n    + update llhttp '2.1.2' -\u003e '2.1.3'\n    + update uv '1.39.0' -\u003e '1.40.0'\n    + update uvwasi '0.0.10' -\u003e '0.0.11'\n  * fs: add .ref() and .unref() methods to watcher classes\n  * http: added scheduling option to http agent\n  * module:\n    + exports pattern support\n    + named exports for CJS via static analysis\n  * n-api: add more property defaults (gh#35214)\n\n- New upstream LTS version 12.19.1:\n  * deps: Denial of Service through DNS request (High).\n  A Node.js application that allows an attacker to trigger a DNS\n  request for a host of their choice could trigger a Denial of Service\n  by getting the application to resolve a DNS record with\n  a larger number of responses (bsc#1178882, CVE-2020-8277)\n\n- New upstream LTS version 12.19.0:\n  * crypto: add randomInt function\n  * deps:\n    + upgrade to libuv 1.39.0\n    + deps: upgrade npm to 6.14.7\n    + deps: upgrade to libuv 1.38.1\n  * doc: deprecate process.umask() with no arguments\n  * module:\n    + package 'imports' field\n    + module: deprecate module.parent\n  * n-api: create N-API version 7\n  * zlib: switch to lazy init for zlib streams\n","status":"published","published":"2021-01-11T14:01:49Z","modified":"2026-02-04T02:33:52.764239Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0068-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- New upstream LTS version 12.20.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 12.20.0:\n  * deps:\n    + update llhttp '2.1.2' -\u003e '2.1.3'\n    + update uv '1.39.0' -\u003e '1.40.0'\n    + update uvwasi '0.0.10' -\u003e '0.0.11'\n  * fs: add .ref() and .unref() methods to watcher classes\n  * http: added scheduling option to http agent\n  * module:\n    + exports pattern support\n    + named exports for CJS via static analysis\n  * n-api: add more property defaults (gh#35214)\n","status":"published","published":"2021-01-11T14:16:56Z","modified":"2026-02-04T03:40:46.479299Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0082-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- New upstream LTS version 10.23.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 10.23.0:\n  * deps: upgrade npm to 6.14.8\n  * n-api:\n    + create N-API version 7\n    + expose napi_build_version variable\n","status":"published","published":"2021-01-12T13:09:37Z","modified":"2026-02-04T03:32:08.004078Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0107-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- New upstream LTS version 14.15.4:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n\n- New upstream LTS version 14.15.3:\n  * deps:\n    + upgrade npm to 6.14.9\n    + update acorn to v8.0.4\n  * http2: check write not scheduled in scope destructor\n  * stream: fix regression on duplex end\n","status":"published","published":"2021-01-13T08:53:01Z","modified":"2026-02-04T03:06:56.935113Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-6380-1","title":"nodejs vulnerabilities","description":"Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. \n(CVE-2019-15604)\n\nEthan Rubinson discovered that Node.js incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-15605)\n\nAlyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-15606)\n\nTobias Niessen discovered that Node.js incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-8174)\n\nIt was discovered that Node.js incorrectly handled certain inputs. If a user\nor an automated system were tricked into opening a specially crafted input\nfile, a remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2020-8265, CVE-2020-8287)\n","status":"published","published":"2023-09-19T07:18:15Z","modified":"2026-06-25T13:32:20.979176372Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}