Security feed

Node.js published security updates for active release lines, including fixes for V8 and HTTP-processing flaws. The announcement also lists libuv-related impact and available releases.

Node.js 6.2.1 ignores negative lengths in Buffer allocation calls, addressing a possible memory exposure when unchecked user input is passed to the Buffer constructor or allocUnsafe().

Node.js 4.4.6 is an important security release related to a V8 Buffer overflow vulnerability.

Node.js security releases are listed, with users directed to a separate summary for details on patched vulnerabilities.

Node.js 5.10.0 updates npm to 3.8.3, restricting authentication tokens in HTTP requests to registries used for the current install and preventing token collection by a malicious server.

Node.js 4.6.0 (LTS) is an important security release that updates OpenSSL and patches HTTP and TLS vulnerabilities, among other security changes.

Node.js 6.7.0 is described as an important security release. It updates OpenSSL and includes fixes for several security issues, including HTTP response splitting and invalid wildcard certificate validation.

Node.js 0.10.44 updates bundled npm to address an authentication-token leak and disables obsolete EXPORT and LOW OpenSSL ciphers.

Node.js 7.2.0 is a security release impacting Windows 10 users. It fixes a potential buffer overflow when writing data to the console on Windows 10.

Node.js 6.9.2 includes a fix for a memory leak during TLS handshakes.

Node.js 4.7.0 includes a TLS memory leak fix and other changes. The announcement does not identify a security vulnerability or CVE.

Node.js 6.9.5 upgrades its OpenSSL sources to 1.0.2k. The announcement does not identify a CVE or explicitly characterize the update as a security fix.

Node.js 4.7.3 updates its OpenSSL sources to 1.0.2k.

Node.js 7.7.0 contains a bug that prevents native modules from loading; a patch release was expected shortly. No security vulnerability or fix is stated.

Node.js 6.10.2 includes a fix for a crypto memory leak when a certificate is revoked.

Node.js 4.8.2 fixes a memory leak when a certificate is revoked.

Node.js 6.10.3 includes fixes for rare TLS segmentation faults and base64 decoding, among other changes.

Node.js 4.8.3 includes fixes for a rare TLS segmentation fault and base64 decoding edge case.

Node.js 8.1.4 disables V8 snapshots to address hash-seed collision risk and includes a c-ares patch for CVE-2017-1000381, which checks that NAPTR records contain required data before processing.

Node.js issued security updates for its active release lines and 7.x, addressing Node.js vulnerabilities and fixes in dependencies. The announcement recommends upgrading affected release lines.