{
  "vulnerabilities": [
    {
      "id": "NSWG-COR-95",
      "title": "NSWG-COR-95",
      "CVSSv3": "-",
      "credit": ["-"],
      "semver": {
        "vulnerable": "14.x || 16.x || 18.x"
      },
      "exploit": "-",
      "patched": ["^14.20.0", "^16.20.0", "^18.5.0"],
      "patches": [],
      "fixedIn": ["^14.20.0", "^16.20.0", "^18.5.0"],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.5,
      "functions": [],
      "moduleName": ".node.js",
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/",
          "title": "Ref"
        }
      ],
      "cvssDetails": [],
      "description": "The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).",
      "epssDetails": null,
      "identifiers": {
        "CVE": ["CVE-2022-32214"]
      },
      "packageName": ".node.js",
      "proprietary": true,
      "creationTime": "-",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "-",
      "packageManager": "npm",
      "publicationTime": "-",
      "modificationTime": "-",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [".node.js@16.19.1"],
      "upgradePath": [],
      "isUpgradable": true,
      "isPatchable": false,
      "name": ".node.js",
      "version": "16.19.1"
    },
    {
      "id": "NSWG-COR-98",
      "title": "NSWG-COR-98",
      "CVSSv3": "-",
      "credit": ["-"],
      "semver": {
        "vulnerable": "14.x || 16.x || 18.x"
      },
      "exploit": "-",
      "patched": ["^14.20.0", "^16.20.0", "^18.5.0"],
      "patches": [],
      "fixedIn": ["^14.20.0", "^16.20.0", "^18.5.0"],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.3,
      "functions": [],
      "moduleName": ".node.js",
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/",
          "title": "Ref"
        }
      ],
      "cvssDetails": [],
      "description": "Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.\nThis vulnerability can be exploited if the victim has the following dependencies on a Windows machine:\n* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.\n\nWhenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.\nAfter that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.\n\nIt is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.",
      "epssDetails": null,
      "identifiers": {
        "CVE": ["CVE-2022-32223"]
      },
      "packageName": ".node.js",
      "proprietary": true,
      "creationTime": "-",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "-",
      "packageManager": "npm",
      "publicationTime": "-",
      "modificationTime": "-",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [".node.js@16.19.1"],
      "upgradePath": [],
      "isUpgradable": true,
      "isPatchable": false,
      "name": ".node.js",
      "version": "16.19.1"
    },
    {
      "id": "NSWG-COR-99",
      "title": "NSWG-COR-99",
      "CVSSv3": "-",
      "credit": ["-"],
      "semver": {
        "vulnerable": "14.x || 16.x || 18.x"
      },
      "exploit": "-",
      "patched": ["^14.20.0", "^16.20.0", "^18.9.1"],
      "patches": [],
      "fixedIn": ["^14.20.0", "^16.20.0", "^18.9.1"],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "moduleName": ".node.js",
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/",
          "title": "Ref"
        }
      ],
      "cvssDetails": [],
      "description": "On linux, versions of 18.x prior to Y used a default path for openssl.cnf  that was within a path that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.",
      "epssDetails": null,
      "identifiers": {
        "CVE": ["CVE-2022-32222"]
      },
      "packageName": ".node.js",
      "proprietary": true,
      "creationTime": "-",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "-",
      "packageManager": "npm",
      "publicationTime": "-",
      "modificationTime": "-",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [".node.js@16.19.1"],
      "upgradePath": [],
      "isUpgradable": true,
      "isPatchable": false,
      "name": ".node.js",
      "version": "16.19.1"
    }
  ]
}