April 2021 Security Releases
Node.js security updates address OpenSSL certificate-check and signature-processing vulnerabilities, plus an npm y18n prototype-pollution issue. Updates are available for the listed Node.js release lines.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.
Node.js
Node.js v10.24.1 (LTS)
- Affected versions
- All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
- Fixed versions
- v10.24.1
Node.js v10.24.1 (LTS)
v12.22.1Node.js v12.22.1 (LTS)
v14.16.1Node.js v14.16.1 (LTS)
v15.14.0Node.js v15.14.0 (Current)
- Prerequisites
- Not stated in this extraction
npm
npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)
- Affected versions
- All versions of the 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 14.x, 12.x and 10.x releases lines
- Fixed versions
- Not stated in this extraction
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2021-3450
CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)
CVE-2021-3449NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)
CVE-2020-7774Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)
Publisher severity
No explicit severity was extracted.