Friday October 13 2023 Security Releases
Security updates are available for Node.js 18.x and 20.x, addressing vulnerabilities in undici, nghttp2, and Node.js features. Downloads include Node.js v18.18.2 and v20.8.1.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for the v18.x and v20.x Node.js release lines for the following issues.
Node.js
Node.js v20.8.1 (Current)
- Affected versions
- 18.x
This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x.
20.xThis vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x.
- Fixed versions
- v20.8.1
Node.js v20.8.1 (Current)
v18.18.2Node.js v18.18.2 (LTS)
- Prerequisites
- experimental permission model
This vulnerability affects all users using the experimental permission model in Node.js 20.x.
experimental policy mechanismThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
--experimental-wasm-modules command line optionThis vulnerability affects users of the --experimental-wasm-modules command line option in all active release lines 18.x and 20.x.
- Related CVEs
- CVE-2023-45143
undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143)
CVE-2023-44487nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487)
CVE-2023-39331Permission model improperly protects against path traversal (High) - (CVE-2023-39331)
CVE-2023-39332Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332)
CVE-2023-38552Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552)
CVE-2023-39333Code injection via WebAssembly export names (Low) - (CVE-2023-39333)
Publisher severity
high
2 high severity issues.