Security feed

Node.js 0.10.31 includes a V8 backport for CVE-2013-6668 and updates OpenSSL to v1.0.1i.

A V8 memory corruption vulnerability in Node.js 0.8 and 0.10 can cause a denial of service when deeply recursive workloads trigger garbage collection and an interrupt. The issue is fixed in Node.js v0.8.28 and v0.10.3…

Node.js 0.10.33 disables SSLv2 and SSLv3 negotiation by default to address the POODLE vulnerability; these protocols can still be enabled explicitly.

io.js 1.3.0 changes the default TLS and HTTPS cipher suite to provide Perfect Forward Secrecy with modern browsers and excludes insecure RC4 ciphers.

io.js 1.4.1 updates V8 to 4.1.0.21, including an embargoed fix, and updates libuv to 1.4.2. The announcement does not identify the security issue or provide severity details.

io.js 1.5.1 reports resolving a TLS memory leak, though testing indicated some leak problems may remain.

Node.js 0.10.38 upgrades OpenSSL to 1.0.1m, which the release says includes fixes for several recently disclosed CVEs.

Node.js 0.12.1 upgrades OpenSSL to 1.0.1m, which includes fixes for several recently disclosed CVEs.

io.js 1.6.4 upgrades npm to 2.7.5, which includes two important security fixes.

io.js 2.1.0 requires Diffie-Hellman parameters to be at least 1024 bits and is reported to fix the Logjam vulnerability.

io.js released versions 1.8.3 and 2.3.3 to fix an out-of-band write in the utf8 decoder that could cause denial of service. The announcement also describes an OpenSSL upgrade in 1.8.3.

Node.js 0.10.40 upgrades OpenSSL to 1.0.1p, which the announcement says fixes a security vulnerability.

Node.js 0.12.6 fixes an out-of-band write in V8's UTF-8 decoder that affects Buffer-to-String conversions and could be used for denial of service.

Node.js 0.12.7 upgrades OpenSSL to 1.0.1p, which the announcement says fixes CVE-2015-1793.

Node.js v4.0.0 includes an npm security update and upgrades npm to version 2.14.2.

The update describes a denial-of-service vulnerability and says a future Node.js v4.x release will include fixes. It does not identify a fixed version in this announcement.

Node.js 4.0.0 bundles npm 2.14.2, which the release notes identify as including a security update. The announcement does not specify the vulnerability or affected versions.

Node.js 4.0.0 combines the Node.js and io.js codebases and includes security updates. The announcement does not identify specific vulnerabilities or affected versions.

io.js v3.3.1 updates npm to version 2.14.3, which the announcement describes as including a security update. The announcement does not identify a specific vulnerability or affected versions.

The announcement describes a denial-of-service vulnerability affecting Node.js v0.12.x through v5.x and a V8 out-of-bounds access vulnerability affecting v4.x and v5.x when user-supplied JavaScript can be executed. It…