Security feed

Node.js 15.5.1 fixes a TLS use-after-free vulnerability and HTTP request smuggling caused by duplicate request headers.

Node.js 10.23.1 (LTS) is a security release fixing TLS use-after-free, HTTP request smuggling, and an OpenSSL null-pointer dereference vulnerability.

Node.js 12.20.1 is a security release that fixes TLS use-after-free, HTTP request smuggling, and an OpenSSL vulnerability reachable through Node.js.

Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versi…

Node.js 14.15.5 is a release containing a V8 backport and other updates; the announcement explicitly says Node.js is not believed to be vulnerable to CVE-2021-21148.

Node.js 10.24.0 fixes vulnerabilities involving HTTP/2 unknownProtocol handling, DNS rebinding in --inspect, and an OpenSSL integer overflow.

Node.js 15.10.0 fixes vulnerabilities involving HTTP/2 unknownProtocol handling and DNS rebinding in --inspect, and includes an OpenSSL update related to an integer-overflow vulnerability.

Node.js 12.21.0 (LTS) includes fixes for vulnerabilities involving HTTP/2 resource exhaustion, DNS rebinding in the inspector, and an OpenSSL integer overflow.

Node.js 14.16.1 updates npm and OpenSSL and fixes listed vulnerabilities affecting Node.js release lines.

Node.js 14.16.0 (LTS) fixes vulnerabilities involving HTTP/2, DNS rebinding in the inspector, and OpenSSL.

Security updates address denial-of-service, DNS rebinding, and OpenSSL integer-overflow vulnerabilities affecting Node.js release lines 10.x, 12.x, 14.x, and 15.x.

Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.

Node.js 10.24.1 fixes vulnerabilities involving OpenSSL and npm’s y18n module.

Node.js 16.4.1 fixes two security vulnerabilities: an out-of-bounds read in libuv and Windows installer permission issues that could enable local privilege escalation.

Node.js 14.17.2 (LTS) fixes vulnerabilities involving an out-of-bounds read in libuv and Windows installer privilege escalation.

Node.js released security updates for the 12.x, 14.x, and 16.x release lines addressing vulnerabilities in libuv, the Windows installer, and npm dependencies.

Node.js 12.22.2 fixes multiple listed vulnerabilities, including out-of-bounds read, Windows local privilege escalation, and denial-of-service flaws in npm dependencies.

Security updates address three vulnerabilities across the Node.js 12.x, 14.x, and 16.x release lines. Updated releases are Node.js v12.22.5, v14.17.5, and v16.6.2.

Node.js 12.22.5 (LTS) addresses vulnerabilities involving domain-name handling, HTTP/2 stream cancellation, and HTTPS certificate validation.

Node.js 14.17.5 addresses vulnerabilities involving DNS hostname validation, HTTP/2 stream cancellation, and HTTPS certificate validation. The release also includes a follow-up fix for CVE-2021-22930.