Security feed

Node.js 12.8.1 is a security release addressing HTTP/2 denial-of-service vulnerabilities.

Node.js 8.16.1 (LTS) is a security release addressing HTTP/2 denial-of-service vulnerabilities.

Node.js 10.16.3 is a security release addressing HTTP/2 denial-of-service vulnerabilities.

OpenSSL planned security releases affecting versions used by Node.js active release lines. The Node.js project had not yet determined whether immediate Node.js security releases were needed.

Node.js 12.13.1 includes a crypto change to reject public keys properly.

Node.js security releases update npm to address vulnerabilities involving global binary overwrites, symlinks outside node_modules, and arbitrary file writes. The announcement says all current release lines were affected.

Node.js 12.15.0 (LTS) is a security release that fixes three vulnerabilities and makes HTTP parsing stricter.

Node.js 10.19.0 is a security release fixing three vulnerabilities and tightening HTTP parsing. The release notes warn that the insecure HTTP parser should be avoided.

Node.js 13.8.0 is a security release fixing three listed vulnerabilities and tightening HTTP parsing; the release notes describe an option to disable strict checks but advise against using it.

Node.js released security updates for all active release lines, addressing HTTP request smuggling, HTTP header whitespace handling, and a TLS server crash, along with stricter HTTP parsing.

The OpenSSL 1.1.1g issue does not affect Node.js because the affected function is not called by Node.js or its dependencies; no Node.js security releases are required.

Node.js released security updates for supported release lines addressing TLS session reuse, HTTP/2 settings-frame denial of service, N-API string-buffer memory corruption, and an ICU issue. Node.js 10.21.0, 12.18.0, a…

Node.js 14.4.0 is a security release fixing TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption vulnerabilities.

Node.js 12.18.0 (LTS) is a security release that fixes three vulnerabilities, including TLS certificate verification bypass, HTTP/2 denial of service, and memory corruption issues.

Node.js 10.21.0 (LTS) is a security release fixing vulnerabilities in N-API, ICU, and HTTP/2.

Node.js 14.11.0 is a security release fixing two vulnerabilities: denial of service from unfinished HTTP/1.1 requests and HTTP request smuggling.

Node.js 12.18.4 is a security release fixing two vulnerabilities.

Node.js security updates address a denial-of-service issue involving DNS requests.

Node.js 12.22.1 includes fixes for OpenSSL and npm-related vulnerabilities.

Node.js 14.15.4 (LTS) fixes three listed vulnerabilities involving OpenSSL, TLSWrap, and HTTP request smuggling.