diff --git a/NEWS b/NEWS
index a894e9f8..8981f78e 100644
--- a/NEWS
+++ b/NEWS
@@ -8,7 +8,7 @@ for the new repo format which should make updates faster and download
 less data.
 
 This release also contains the security fixes from 1.8.5, so everyone
-on the 1.9.x series should update immediately.
+on the 1.9.x series should update immediately. (CVE-2021-21261)
 
 Other changes since 1.9.3: