# CVE-2017-15896: Node.js 4 and 1 other: Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to…

CVE-2017-15896 is fixed in 2 products on 1 platform, first by Node.js 4 4.8.7, released December 7, 2017. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2017-15896
- Priority: Urgent
- CVSS: 9.1
- EPSS: 0.0239
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Dec 11, 2017
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2017-15896

## Description

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 4 | 4.8.7 | [Node.js 4 4.8.7](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.4-4.8.7.md) | Dec 7, 2017 |
| Windows apps | Node.js 6 | 6.12.2 | [Node.js 6 6.12.2](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.6-6.12.2.md) | Dec 7, 2017 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo