January 2021 Security Releases
Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versions.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Security releases available Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.
Node.js
Node.js v10.23.1 (LTS)
- Affected versions
- All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
- Fixed versions
- Node.js v10.23.1 (LTS)
Node.js v10.23.1 (LTS)
Node.js v12.20.1 (LTS)Node.js v12.20.1 (LTS)
Node.js v14.15.4 (LTS)Node.js v14.15.4 (LTS)
Node.js v15.5.1 (Current)Node.js v15.5.1 (Current)
- Prerequisites
- Not stated in this extraction
OpenSSL
OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
- Affected versions
- All versions of the 14.x, 12.x and 10.x release lines
Impacts: All versions of the 14.x, 12.x and 10.x release lines
Versions of the 15.x line before 15.5.0Versions of the 15.x line before 15.5.0 which included an update to the latest OpenSSL.
- Fixed versions
- Not stated in this extraction
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2020-8265
use-after-free in TLSWrap (High) (CVE-2020-8265)
CVE-2020-8287HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)
CVE-2020-1971OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
Publisher severity
No explicit severity was extracted.