Advisories usually give the vulnerability identifier, affected release lines, severity, exploit conditions and links to fixed builds. Some include indicators of compromise, workarounds or a statement on whether attacks have been observed. Details can change as an investigation continues.
A vendor advisory is more specific than a broad scanner alert because it explains what the maintainer actually shipped. For backported patches, a package may keep an older upstream version string even though the vendor has applied the required source change.
Advisories must be matched to the installed product and packaging channel. The Node.js project, a Linux distributor, a cloud host and a product embedding Node.js may issue different instructions for different copies of the same underlying component.
Use the official bulletin to identify the applicable fix, document its publication date and record the installed package build. Recheck updates and verify running processes after deployment; a download or package installation alone is not proof that patched code is executing.