{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Node.js versions v24.x avec OpenSSL version 3.5.4",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions v25.x avec OpenSSL version 3.5.4",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions v20.x avec OpenSSL version 3.0.15",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions v22.x avec OpenSSL version 3.5.4",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur estime que la surface d\u0027attaque permettant d\u0027exploiter ces vuln\u00e9rabilit\u00e9 est faible et fournira les correctifs pour OpenSSL dans une mise \u00e0 jour normale \u00e0 une date ult\u00e9rieure.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-22795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22795"
    },
    {
      "name": "CVE-2025-69421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-69421"
    },
    {
      "name": "CVE-2025-11187",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11187"
    }
  ],
  "initial_release_date": "2026-01-30T00:00:00",
  "last_revision_date": "2026-01-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0103",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-01-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Node.js. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Node.js",
  "vendor_advisories": [
    {
      "published_at": "2026-01-28",
      "title": "Bulletin de s\u00e9curit\u00e9 Node.js openssl-fixes-in-regular-releases-jan2026",
      "url": "https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-jan2026"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Node.js versions 24.x ant\u00e9rieures \u00e0 24.13.0",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions 25.x ant\u00e9rieures \u00e0 25.3.0",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions 22.x ant\u00e9rieures \u00e0 22.22.0",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions 20.x ant\u00e9rieures \u00e0 20.20.0",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-21637",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21637"
    },
    {
      "name": "CVE-2025-55130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-55130"
    },
    {
      "name": "CVE-2025-55131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-55131"
    },
    {
      "name": "CVE-2025-59465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-59465"
    },
    {
      "name": "CVE-2026-21636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21636"
    },
    {
      "name": "CVE-2025-55132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-55132"
    },
    {
      "name": "CVE-2025-59466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-59466"
    },
    {
      "name": "CVE-2025-59464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-59464"
    }
  ],
  "initial_release_date": "2026-01-14T00:00:00",
  "last_revision_date": "2026-01-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0039",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-01-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Node.js. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Node.js",
  "vendor_advisories": [
    {
      "published_at": "2026-01-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Node.js december-2025-security-releases",
      "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Node.js versions 20.x ant\u00e9rieures \u00e0 la version corrective pr\u00e9vue pour le 15 juillet 2025",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions 22.x ant\u00e9rieures \u00e0 la version corrective pr\u00e9vue pour le 15 juillet 2025",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions 24.x ant\u00e9rieures \u00e0 la version corrective pr\u00e9vue pour le 15 juillet 2025",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2025-07-09T00:00:00",
  "last_revision_date": "2025-07-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0573",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Node.js. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Node.js",
  "vendor_advisories": [
    {
      "published_at": "2025-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Node.js",
      "url": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Node.js versions 22.x ant\u00e9rieures \u00e0 22.15.1",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions 20.x ant\u00e9rieures \u00e0 20.19.2",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions 24.x ant\u00e9rieures \u00e0 24.0.2",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions 23.x ant\u00e9rieures \u00e0 23.11.1",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-23167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23167"
    },
    {
      "name": "CVE-2025-23165",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23165"
    },
    {
      "name": "CVE-2025-23166",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23166"
    }
  ],
  "initial_release_date": "2025-05-21T00:00:00",
  "last_revision_date": "2025-05-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0434",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Node.js. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Node.js",
  "vendor_advisories": [
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Node.js",
      "url": "https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-http-header-block-termination-in-llhttp-cve-2025-23167---medium"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Node.js versions v23.x ant\u00e9rieures \u00e0 v23.6.1",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions v20.x ant\u00e9rieures \u00e0 v20.18.2",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions v18.x ant\u00e9rieures \u00e0 v18.20.6",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    },
    {
      "description": "Node.js versions v22.x ant\u00e9rieures \u00e0 v22.13.1",
      "product": {
        "name": "Node.js",
        "vendor": {
          "name": "Node.js",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-23088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23088"
    },
    {
      "name": "CVE-2025-23085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23085"
    },
    {
      "name": "CVE-2025-23083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23083"
    },
    {
      "name": "CVE-2025-23087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23087"
    },
    {
      "name": "CVE-2025-23084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23084"
    },
    {
      "name": "CVE-2025-23089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23089"
    }
  ],
  "initial_release_date": "2025-01-22T00:00:00",
  "last_revision_date": "2025-01-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0060",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-01-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Node.js. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Node.js",
  "vendor_advisories": [
    {
      "published_at": "2025-01-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Node.js",
      "url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases"
    }
  ]
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-18T17:35:41.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kb.cert.org/vuls/id/123335"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/123335"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nodejs",
            "vendor": "nodejs",
            "versions": [
              {
                "lessThanOrEqual": "21.7.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "process_library",
            "vendor": "haskell",
            "versions": [
              {
                "lessThan": "1.6.19.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rust",
            "vendor": "rust-lang",
            "versions": [
              {
                "lessThan": "1.77.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:thephpgroup:thephpgroup:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thephpgroup",
            "vendor": "thephpgroup",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:yt-dlp_project:yt-dlp:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "yt-dlp",
            "vendor": "yt-dlp_project",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-3566",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-15T16:13:02.290928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T18:25:43.487Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Node.js",
          "vendor": "Node.js",
          "versions": [
            {
              "lessThanOrEqual": "21.7.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "GoLang",
          "vendor": "Go Programming Language",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Haskel",
          "vendor": "Haskell Programming Language",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-10T15:26:52.009Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
        },
        {
          "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
        },
        {
          "url": "https://kb.cert.org/vuls/id/123335"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
        },
        {
          "url": "https://www.kb.cert.org/vuls/id/123335"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Command injection vulnerability in programing languages on Microsoft Windows operating system.",
      "x_generator": {
        "engine": "VINCE 2.1.12",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2024-3566"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2024-3566",
    "datePublished": "2024-04-10T15:22:56.099Z",
    "dateReserved": "2024-04-10T04:58:27.982Z",
    "dateUpdated": "2025-11-18T17:35:41.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:01:52.297Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
          },
          {
            "name": "openSUSE-SU-2019:1076",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
          },
          {
            "name": "openSUSE-SU-2019:1173",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
          },
          {
            "name": "GLSA-202003-48",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-48"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Node.js",
          "vendor": "Node.js",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 6.17.0"
            }
          ]
        }
      ],
      "datePublic": "2019-02-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption / Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-20T20:06:15.000Z",
        "orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558",
        "shortName": "nodejs"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
        },
        {
          "name": "openSUSE-SU-2019:1076",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
        },
        {
          "name": "openSUSE-SU-2019:1173",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
        },
        {
          "name": "GLSA-202003-48",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-48"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-request@iojs.org",
          "ID": "CVE-2019-5739",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Node.js",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to 6.17.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Node.js"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption / Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/",
              "refsource": "MISC",
              "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
            },
            {
              "name": "openSUSE-SU-2019:1076",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
            },
            {
              "name": "openSUSE-SU-2019:1173",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190502-0008/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
            },
            {
              "name": "GLSA-202003-48",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-48"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558",
    "assignerShortName": "nodejs",
    "cveId": "CVE-2019-5739",
    "datePublished": "2019-03-28T16:27:34.000Z",
    "dateReserved": "2019-01-09T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:01:52.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:01:52.386Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
          },
          {
            "name": "openSUSE-SU-2019:1076",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
          },
          {
            "name": "openSUSE-SU-2019:1173",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
          },
          {
            "name": "openSUSE-SU-2019:1211",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
          },
          {
            "name": "RHSA-2019:1821",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1821"
          },
          {
            "name": "GLSA-202003-48",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-48"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Node.js",
          "vendor": "Node.js",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 6.17.0"
            },
            {
              "status": "affected",
              "version": "All versions prior to 8.15.1"
            },
            {
              "status": "affected",
              "version": "All versions prior to 10.15.2"
            },
            {
              "status": "affected",
              "version": "All versions prior to 11.10.1"
            }
          ]
        }
      ],
      "datePublic": "2019-02-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption / Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-20T20:06:11.000Z",
        "orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558",
        "shortName": "nodejs"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
        },
        {
          "name": "openSUSE-SU-2019:1076",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
        },
        {
          "name": "openSUSE-SU-2019:1173",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
        },
        {
          "name": "openSUSE-SU-2019:1211",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
        },
        {
          "name": "RHSA-2019:1821",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1821"
        },
        {
          "name": "GLSA-202003-48",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-48"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-request@iojs.org",
          "ID": "CVE-2019-5737",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Node.js",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to 6.17.0"
                          },
                          {
                            "version_value": "All versions prior to 8.15.1"
                          },
                          {
                            "version_value": "All versions prior to 10.15.2"
                          },
                          {
                            "version_value": "All versions prior to 11.10.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Node.js"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption / Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/",
              "refsource": "MISC",
              "url": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/"
            },
            {
              "name": "openSUSE-SU-2019:1076",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html"
            },
            {
              "name": "openSUSE-SU-2019:1173",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html"
            },
            {
              "name": "openSUSE-SU-2019:1211",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190502-0008/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190502-0008/"
            },
            {
              "name": "RHSA-2019:1821",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1821"
            },
            {
              "name": "GLSA-202003-48",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-48"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558",
    "assignerShortName": "nodejs",
    "cveId": "CVE-2019-5737",
    "datePublished": "2019-03-28T16:20:28.000Z",
    "dateReserved": "2019-01-09T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:01:52.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}