Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 12.15.0 (LTS)

Node.js 12.15.0 (LTS) is a security release that fixes three vulnerabilities and makes HTTP parsing stricter.

Announced

Node.js · Fixed in 12.15.0CVE-2019-15606CVE-2019-15605CVE-2019-15604
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Vulnerabilities fixed: CVE-2019-15606: HTTP header values do not have trailing OWS trimmed. CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header. CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.

Node.js

Node.js 12.15.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.15.0
Node.js 12.15.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2019-15606
CVE-2019-15606: HTTP header values do not have trailing OWS trimmed.
CVE-2019-15605
CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header.
CVE-2019-15604
CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.

Publisher severity

No explicit severity was extracted.

Event
#46730 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 10.19.0 (LTS)

Node.js 10.19.0 is a security release fixing three vulnerabilities and tightening HTTP parsing. The release notes warn that the insecure HTTP parser should be avoided.

Announced

Node.js · Fixed in 10.19.0CVE-2019-15606CVE-2019-15605CVE-2019-15604
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Vulnerabilities fixed:

Node.js

Node.js 10.19.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
10.19.0
Node.js 10.19.0 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2019-15606
CVE-2019-15606: HTTP header values do not have trailing OWS trimmed.
CVE-2019-15605
CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header.
CVE-2019-15604
CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.

Publisher severity

No explicit severity was extracted.

Event
#46729 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 13.8.0 (Current)

Node.js 13.8.0 is a security release fixing three listed vulnerabilities and tightening HTTP parsing; the release notes describe an option to disable strict checks but advise against using it.

Announced

Node.js · Fixed in 13.8.0CVE-2019-15606CVE-2019-15605CVE-2019-15604
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. Vulnerabilities fixed:

Node.js

Node.js 13.8.0 (Current)
Affected versions
Not stated in this extraction
Fixed versions
13.8.0
Node.js 13.8.0 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2019-15606
CVE-2019-15606: HTTP header values do not have trailing OWS trimmed.
CVE-2019-15605
CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header.
CVE-2019-15604
CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.

Publisher severity

No explicit severity was extracted.

Event
#46704 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

February 2020 Security Releases

Node.js released security updates for all active release lines, addressing HTTP request smuggling, HTTP header whitespace handling, and a TLS server crash, along with stricter HTTP parsing.

Announced

Node.js · Fixed in Node.js v10.19.0 (LTS), Node.js v12.15.0 (LTS), Node.js v13.8.0 (Current)CVE-2019-15605CVE-2019-15606CVE-2019-15604
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for all active Node.js release lines for the following issues.

Node.js

Node.js v10.19.0 (LTS)
Affected versions
10.x
All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable.
12.x
All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable.
13.x
All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable.
Fixed versions
Node.js v10.19.0 (LTS)
Node.js v10.19.0 (LTS)
Node.js v12.15.0 (LTS)
Node.js v12.15.0 (LTS)
Node.js v13.8.0 (Current)
Node.js v13.8.0 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2019-15605
HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)
CVE-2019-15606
HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606)
CVE-2019-15604
Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604)

Publisher severity

No explicit severity was extracted.

Event
#46500 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement