Security feed

Node.js 5.0.0 raises the default minimum DH key size for tls.connect() to 1024 bits and warns when the key size is below 2048 bits, as a security consideration against Logjam attacks.

Node.js 0.12.8 is a release that includes security updates, but the announcement does not identify specific vulnerabilities.

The announcement says upcoming Node.js releases will include fixes for CVE-2015-8027 across v0.12.x, v4.x, and v5.x, and for CVE-2015-6764 in v4.x and v5.x. It does not specify fixed versions.

Node.js postponed its planned security releases to include upstream OpenSSL fixes and announced vulnerabilities affecting several Node.js release lines. Fixes were planned for v4.x and v5.x for CVE-2015-6764, alongsid…

This security release fixes an HTTP pipelining denial-of-service issue and upgrades OpenSSL to 1.0.1q, which fixes CVE-2015-3194.

Node.js 5.1.1 is described as an important security release. It upgrades OpenSSL to 1.0.2e and includes fixes for HTTP and V8 issues with potential denial-of-service or out-of-bounds-read impacts.

Node.js released security updates for four versions, with fixes for announced vulnerabilities and OpenSSL updates. Users are advised to update their installations.

Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.

Node.js 4.3.0 is an important security release. It changes HTTP header parsing to address request smuggling and response splitting, and updates OpenSSL and http-parser.

Node.js released security updates for four release lines, including fixes for announced vulnerabilities and OpenSSL updates. The v4.2.x line is no longer updated; users are advised to upgrade.

Node.js 4.3.2 upgrades OpenSSL to 1.0.2g, fixing defects associated with denial of service or memory corruption, and the CacheBleed side-channel attack.

Node.js 5.7.1 upgrades OpenSSL to 1.0.2g and includes fixes for defects associated with three CVEs. The announcement describes the issues as low severity for Node.js users or unlikely to enable practical attacks in No…

Node.js 0.12.11 includes security updates through an OpenSSL upgrade to 1.0.1s, addressing several low-severity defects.

Node.js 0.10.43 updates the bundled OpenSSL to 1.0.1s, which includes security fixes, and removes SSLv2 support.

Node.js 0.12.12 removes SSLv2 support and makes the --enable-ssl2 argument produce an error, addressing the risk associated with SSLv2 being enabled.

Node.js 5.9.0 fixes a memory consumption issue associated with heavy use of vm.createContext and vm.runInNewContext.

Node.js 0.12.13 upgrades bundled npm to 2.15.1, fixing authentication-token exposure in HTTP requests, and disables obsolete EXPORT and LOW ciphers.

Node.js 4.4.2 updates npm to 2.15.1, correcting token handling so authentication tokens are sent only to the registry or registries used for the current install.

Node.js 5.11.1 includes a buffer safeguard and upgrades its OpenSSL sources to 1.0.2h.

Node.js 4.4.4 updates OpenSSL to 1.0.2h and refers readers to a blog post for security details.