Security feed

Node.js 6.11.2 updates OpenSSL and root certificates, among other changes. The announcement does not identify a specific security issue or CVE.

Node.js 8.5.0 was vulnerable to a path validation issue that could let an attacker access unintended file system paths. The issue was resolved in a new Node.js 8.x release by partially reverting a change.

Node.js releases for active lines include the OpenSSL 1.0.2m update, addressing OpenSSL security flaws. The announcement says the impact is low and does not classify these as strictly security releases.

Node.js 4.8.6 updates root certificates and upgrades its OpenSSL sources to 1.0.2m.

Node.js 9.1.0 includes an OpenSSL upgrade to 1.0.2m and fixes an HTTP 'connect' event handler leak.

Node.js 8.9.1 updates its OpenSSL sources to 1.0.2m. The announcement does not explicitly identify a security issue or CVE.

Node.js 6.12.2 updates its bundled OpenSSL sources to 1.0.2n.

Node.js 8.9.3 (LTS) updates its bundled OpenSSL sources to 1.0.2n and changes buffers allocated with invalid content to be zero-filled.

Node.js 9.2.1 updates its bundled OpenSSL sources to 1.0.2n and changes buffers allocated with invalid content to be zero-filled.

The announcement says the risk to Node.js systems comes from the operating system, not the Node.js runtime. Apply operating-system security patches; no Node.js runtime update is needed.

Node.js 6.14.3 fixes a denial-of-service vulnerability involving Buffer.fill() hanging.

Node.js 10.5.0 includes an OpenSSL dependency update referencing CVE-2018-0732.

Node.js 6.15.1 corrects a backport issue related to the Slowloris HTTP denial-of-service fix. Users of Node.js 6.x LTS 'Boron' are advised to upgrade.

Node.js security releases address multiple vulnerabilities across active release lines. Upgrade to the listed release versions; OpenSSL dependencies are also updated in Node.js 6, 8, 10 and 11.

Node.js 12.0.0 includes changes described as hardening validation in Buffer, child_process, and fs, along with updates to bundled dependencies. The announcement does not identify these changes as security fixes or sta…

Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.

Node.js 10.15.2 addresses a Slowloris HTTP denial-of-service vulnerability by applying the receive timeout consistently to keep-alive connections.

Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.

Node.js 11.10.1 includes a fix to prevent Slowloris attacks on HTTP and HTTPS keep-alive connections.

Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.